2594 matches found
CVE-2023-3279
The CVE-2023-3279 issue affects the WordPress NextGEN Gallery Plugin (versions prior to 3.39). The root cause is the plugin not validating certain block attributes before using them to build paths for include/require calls, enabling an administrator to perform Local File Inclusion (LFI) attacks. ...
NextGEN Gallery < 3.39 - Admin+ Local File Inclusion
Description The plugin does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks PoC 1. Create a gallery and upload an image. 2. Add the NextGEN Gallery block to a page and click Edit. Select the Gallery...
FileMage Gateway 1.10.9 Local File Inclusion
Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion Date: 8/22/2023 Exploit Author: Bryce "Raindayzz" Harty Vendor Homepage: https://www.filemage.io/ Version: Azure Versions 1.10.9 Tested on: All Azure deployments 1.10.9 CVE : CVE-2023-39026 Technical Blog -...
CVE-2023-39699
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion LFI vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server...
CVE-2023-39699
CVE-2023-39699 affects IceWarp Mail Server v10.4.5 via a Local File Inclusion (LFI) in the /calendar/minimizer/index.php component. The vulnerability allows an attacker to include or execute files from the server’s local filesystem. Documented impact is high (potential code execution/unauthorized...
Exploit for Unrestricted Upload of File with Dangerous Type in Thimpress Learnpress
CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated...
GHSA-67C6-Q4J4-HCCG Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulat...
Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Impact The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulat...
GHSA-XVHG-W6QC-M3QQ Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...
CVE-2023-40023
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...
Remote code execution
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...
CVE-2023-40023 Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...
CVE-2023-40023
The CVE-2023-40023 issue affects the Yak Engine (Yaklang) plugin’s Fuzztag component, which contains a Local File Inclusion (LFI) flaw that can allow an attacker to read files from the server’s local filesystem via the web application. Affected are versions prior to 1.2.4-sp1; the vulnerability i...
CVE-2023-40023 Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...
Local File Inclusion (LFI)
dmidecode is vulnerable to local file inclusion LFI attacks. The vulnerability exists because the library enables -dump-bin to overwrite a local file, which allows execution of Dmidecode via Sudo...
Ciuis CRM 1.0.7 Local File Inclusion
==================================================================================================================================== | Title : Ciuis™ CRM v1.0.7 LFI Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.264-bit | | Vendor :...
Design/Logic Flaw
Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...
