2885 matches found
CVE-2026-100750: Server-Side Request Forgery (SSRF)
Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...
Exploit for CVE-2026-87902
CVE-2026-87902 — WordPress Core · LFI → RCE Exploit no aute...
Exploit for CVE-2026-87902
CVE-2026-87902 — WordPress Core Unauthenticated Local File Inc...
WordPress WebFacing Email Accounts for cPanel plugin 5.3-5.3.6 - Unauthenticated LFI vulnerability
Unauthenticated LFI vulnerability discovered by nobody in WordPress Plugin WebFacing Email Accounts for cPanel versions 5.3-5.3.6...
CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...
Pulse Connect Secure SSL VPN Arbitrary File Read
Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...
Ivanti Avalanche 6.3.2 - Local File Inclusion
Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder. id: CVE-2021-30497 info: name: Ivanti Avalanche 6.3.2 - Local File Inclusion author: gy741 severity: high description: Ivanti Avalanch...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
Exploit for CVE-2026-87902
Lab + Exploit — CVE-2026-87902 Lab deliberadamente vulneráv...
CVE-2026-97730: Path Traversal: '../filedir'
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...
Exploit for CVE-2026-12227
CVE-2026-12227 — Visual Composer Website Builder Unauthenticat...
Exploit for CVE-2026-87902
cve-2026-87902 CVE-2026-87902 – WordPress Core LFI to RCE E...
CVE-2026-88843 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
CVE-2026-88843
The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) contains a vulnerability where a display-style setting is not properly validated when building a template path. This flaw allows users with the Contributor role or higher to perform local file inclusion and execute arbitrary local PHP...
CVE-2026-88843 MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...
WordPress MasterStudy LMS WordPress Plugin plugin 3.5.29-3.7.49 - Contributor+ LFI vulnerability
Contributor+ LFI vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.5.29-3.7.49...
Rails File Content Disclosure
Rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system's file system to be exposed. id: CVE-2019-5418 info: name: Rails File Content Disclosure...