CVE-2022-26646

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

Design/Logic Flaw

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

CVE-2022-26646

CVE-2022-26646 affects Online Banking System Protect v1.0 via a local file inclusion (LFI) vulnerability driven by the pages parameter. Several connected sources confirm an unauthenticated LFI that can read internal PHP files and, per an exploit reference, enable privilege escalation from a null ...

CVE-2022-26646

Online Banking System Protect v1.0 was discovered to contain a local file inclusion LFI vulnerability via the pages parameter...

Sports Complex Booking System 1.0 Local File Inclusion Vulnerability

Title: Sports Complex Booking System 1.0 LFI To RCE Author: Hejap Zairy Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs1.zip Reference:...

Videos sync PDF <= 1.7.4 - Unauthenticated LFI

The plugin does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues PoC https://example.com/wp-content/plugins/video-synchro-pdf/reglages/MenuPlugins/tout.php?p=LFI...

Cab fare calculator < 1.0.4 - Unauthenticated LFI

The plugin does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues. Despite what the original advisory claims, the issue is not exploitable by accessing the file directly as a fatal error is triggered before the vulnerable...

WordPress video-synchro-pdf 1.7.4 Plugin - Local File Inclusion Vulnerability

Exploit Title: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion Google Dork: inurl:/wp-content/plugins/video-synchro-pdf/ Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/video-synchro-pdf/ Version: 1.7.4 Tested on: Firefox Vulnerable...

CVE-2022-0679 Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of...

PDF Generator Web App Using TCPDF 1.0 Local File Inclusion

Title: PDF Generator Web App using TCPDF 1.0 LFI To RCE Author: Hejap Zairy Date: 26.07.2022 Vendor: https://www.sourcecodester.com/php/15243/pdf-generator-web-app-using-tcpdf-and-phpoop-free-source-code.html...

WordPress Amministrazione Aperta plugin <= 3.7.3 - Local File Inclusion (LFI) vulnerability

Local File Inclusion LFI vulnerability discovered by Hassan Khan Yusufzai Splint3r7 in WordPress Amministrazione Aperta plugin versions = 3.7.3. Solution Update the WordPress Amministrazione Aperta plugin to the latest available version at least 3.8...

Amministrazione Aperta < 3.8 - Admin+ LFI

The plugin does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected...

Amministrazione Aperta < 3.8 - Admin+ LFI

The plugin does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache2 2.4.49 - LFI & RCE Exploit Info...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache2 2.4.49 - LFI & RCE Exploit Info...

CVE-2021-24825 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI

The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion...

WordPress Narnoo Distributor plugin <= 2.5.1 - Unauthenticated Local File Inclusion (LFI) vulnerability leading to Arbitrary File Read / RCE

Unauthenticated Local File Inclusion LFI vulnerability leading to Arbitrary File Read / RCE discovered by cydave in WordPress Narnoo Distributor plugin versions = 2.5.1. Solution Deactivate and delete. This plugin has been closed as of February 18, 2022 and is not available for download. This...

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

The plugin fails to validate and sanitize the libpath parameter before it is passed into a call to require via the narnoodistributorlibrequest AJAX action available to both unauthenticated and authenticated users which results in the disclosure of arbitrary files as the content of the file is the...

IBM: Public Jenkins instance with /script enabled

An RCE/LFI due to Public Jenkins instance with /script enabled was reported to IBM February 26th, analyzed and has been remediated since March 3rd, 2022. Thank you to Sanjok Karki thesanjok for the finding. RCE/LFI due to Public Jenkins instance with /script enabled...

CVE-2021-25082

CVE-2021-25082 affects the WordPress plugin Popup Builder, pre-4.0.7. A local file inclusion (LFI) exists due to unsanitized and unvalidated sgpb_type being used in a require statement. An attacker controllling the beginning of sgpb_type can leverage this to include arbitrary local files and pote...