CVE-2024-1644

CVE-2024-1644 affects SuiteCRM v7.14.2, where a Local File Inclusion (LFI) vulnerability allows including local PHP files. Multiple connected sources describe the issue as a code vulnerability enabling LFI, with some references explicitly noting possible Remote Code Execution (RCE) via LFI. The r...

CVE-2024-1644: Unrestricted Upload of File with Dangerous Type

Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI...

Local File Inclusion (LFI)

zmarkdown is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper restrictions of images paths within LaTeX documents. This allowed an attacker to specify a local file path e.g., /tmp/img.png in the image markdown syntax which leads to Local File Inclusion LFI, resulting i...

Cacti pollers.php SQL Injection / Remote Code Execution Exploit

This Metasploit exploit module leverages sql injection and local file inclusion vulnerabilities in Cacti versions prior to 1.2.26 to achieve remote code execution. Authentication is needed and the account must have access to the vulnerable PHP script pollers.php. This is granted by setting the...

Cacti pollers.php SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cacti RCE via SQLi in pollers.php', 'Description' = %q This exploit module leverages a SQLi CVE-2023-49085 and a LFI CVE-2023-49084 vulnerability...

CVE-2021-24566

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

Code injection

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2021-24566

CVE-2021-24566 affects the WooCommerce Currency Switcher FOX WordPress plugin prior to 1.3.7. The vulnerability is a Local File Inclusion (LFI) via the woocs shortcode that can be exploited to access files on the server. Some sources characterize exploitation as Authenticated (Low Privilege) LFI ...

CVE-2021-24566 WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2021-24566 WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2021-24566: Improper Limitation of a Pathname to a Restricted Directory

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode...

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

Unrestricted file upload

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

CVE-2023-49715

CVE-2023-49715 is an unrestricted PHP file upload vulnerability in WWBN AVideo’s import.json.php temporary copy function (commit 15fed957fb). The vulnerability allows an attacker to upload a PHP payload via the upload pathway and, in combination with a Local File Inclusion, could lead to arbitrar...

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

CVE-2023-49715: Unrestricted Upload of File with Dangerous Type

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

WWBN AVideo import.json.php temporary copy unrestricted php file upload vulnerability

Talos Vulnerability Report TALOS-2023-1885 WWBN AVideo import.json.php temporary copy unrestricted php file upload vulnerability January 10, 2024 CVE Number CVE-2023-49715 SUMMARY A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVide...

WordPress SiteOrigin Widgets Bundle Plugin < 1.51.0 LFI Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:siteorigin:siteoriginwidgetsbundle"; if description...

Exploit for CVE-2023-6553

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Ex...

CVE-2023-5672 WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint

The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files...