WordPress CAPTCHA 4WP plugin <= 7.0.6.1 - Local File Inclusion (LFI) via Cross-Site Request Forgery (CSRF) vulnerability

Local File Inclusion LFI via Cross-Site Request Forgery CSRF vulnerability was discovered by ZhongFu Su JrXnm in the WordPress CAPTCHA 4WP plugin versions = 7.0.6.1. Solution Update the WordPress CAPTCHA 4WP plugin to the latest available version at least 7.1.0...

CVE-2022-23167

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

CVE-2022-23167: Undefined Security Weakness

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

CVE-2022-29597

CVE-2022-29597 affects Solutions Atlantic Regulatory Reporting System (RRS) v500. It exposes a Local File Inclusion (LFI) vulnerability via the ShowDocument/ShowDocument.aspx page, where an authenticated user can abuse the fileName parameter to reference internal system files (eg. web.config) and...

CVE-2022-29597: Improper Limitation of a Pathname to a Restricted Directory

Solutions Atlantic Regulatory Reporting System RRS v500 is vulnerable to Local File Inclusion LFI. Any authenticated user has the ability to reference internal system files within requests made to the RRSWeb/maint/ShowDocument/ShowDocument.aspx page. The server will successfully respond with the...

CVE-2021-26633 Maxboard SQL injection and LFI vulnerability

SQL injection and Local File Inclusion LFI vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file...

CVE-2021-26633

CVE-2021-26633 affects MaxBoard, a CMS/web framework. The connected sources describe a two-pronged vulnerability: SQL Injection and Local File Inclusion (LFI) in MaxBoard that can cause information leakage and privilege escalation. The root cause is manipulation of input variables to insert arbit...

CVE-2022-29447 WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...

CVE-2022-29447

CVE-2022-29447 concerns the WordPress Hover Effects plugin (versions

Design/Logic Flaw

Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...

CVE-2022-29448

CVE-2022-29448 describes a Local File Inclusion (LFI) vulnerability in WordPress Herd Effects plugin prior to or at version 5.2, requiring an authenticated admin or higher user to exploit. The issue stems from inadequate validation in how local file resources are selected for inclusion, allowing ...

PT-2022-19622

Name of the Vulnerable Software and Affected Versions Herd Effects plugin versions = 5.2 Description The issue is an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with admin or higher user role privileges can potentially include and execute local files on the...

PT-2022-19621

Name of the Vulnerable Software and Affected Versions Hover Effects plugin versions = 2.1 Description The issue is related to an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with administrator or higher user role privileges can potentially include and execute...

CVE-2022-29447: Files or Directories Accessible to External Parties

Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...

CVE-2022-29448: Use of Incorrectly-Resolved Name or Reference

Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...

CVE-2022-29446

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...

CVE-2022-29446 WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...

CVE-2022-29446

CVE-2022-29446 describes an authenticated Local File Inclusion (LFI) vulnerability in Wow-Company’s WordPress Counter Box plugin, versions

PT-2022-19620

Name of the Vulnerable Software and Affected Versions Counter Box plugin versions prior to 1.1.2 Description The issue is related to an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with administrator or higher role access can potentially include and execute...

CVE-2022-29446: Files or Directories Accessible to External Parties

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...