Exploit for CVE-2026-87902

CVE‑2026‑87902 – WordPress Unauth LFI→RCE...

CVE-2026-68536

A flaw was found in Apache MyFaces Core. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF, which can trick the server into making requests to arbitrary domains, potentially accessing internal resources. Additionally, Local File Inclusion LFI is possible,...

Exploit for CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Vali...

Exploit for CVE-2026-87902

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetem...

Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion

Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests. id: CVE-2017-1000028 info: name: Oracle GlassFish Server Open Source Edition 4.1 - Loc...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

Exploit for CVE-2026-87902

CVE-2026-87902 — Unauthenticated local file inclusion in WordP...

Exploit for CVE-2026-87902

abraxaslabs.tech · github.com/abraxas ·&...

WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by 0xQRx in WordPress Plugin WP Travel Engine versions = 6.8.0...

Check Point Quantum Gateway - Information Disclosure

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available. id: CVE-2024-24919 info: name: Check Poi...

WordPress All Bootstrap Blocks plugin 1.3.20-1.3.31 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions 1.3.20-1.3.31...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-54670 WeGIA: Unauthenticated Auth Bypass + Local File Inclusion

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

CVE-2026-54670

WeGIA , a web manager for charitable institutions, has a critical vulnerability (CVSS 9.1 ) in its contribution request dispatcher at web/html/contribuicao/controller/control.php. Prior to version 3.8.5 , the dispatcher accepts attacker-controlled nomeClasse and metodo parameters without a comple...

CVE-2026-68536

A flaw in Apache MyFaces Core allows a remote attacker to perform Server-Side Request Forgery (SSRF) , which can trick the server into making requests to arbitrary domains to access internal resources. Additionally, the vulnerability allows for Local File Inclusion (LFI) , enabling attackers to i...

CVE-2026-68536 Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

EUVD-2026-80990

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...

CVE-2026-27556

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27556

A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint of a VDE (Verband der Elektrotechnik) device allows a low-privileged remote attacker with a valid operator cookie to execute arbitrary PHP code on the device. The CNA is cert.vde.com , and related advisories...