CVE-2026-65481: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Vino = 1.9 versions...

LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

Summary A Server-Side Request Forgery SSRF vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. This can lead to the exposure of sensitive internal services, reconnaissance of the internal network, or...

CVE-2026-39938: Improper Limitation of a Pathname to a Restricted Directory

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...

CVE-2026-34894: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Integrio Core 1.2.8 versions...

CVE-2025-69144: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Preservation = 1.10 versions...

CVE-2025-69126: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Fortius = 2.3.0 versions...

CVE-2025-69141: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Kelly Young = 1.1.0 versions...

ANT-2026-HHD77M82 · joomla · Path-traversal

path-traversal high CVE-2026-40383 GHSA-v8h9-9g8j-w7h4 Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-HHD77M82: Path Traversa...

PHANTOM_old

PHANTOM Autonomous Penetration Testing Framework Recon -...

CVE-2026-29962: External Control of File Name or Path

HSC MailInspector v5.3.3-7 contains a Local File Inclusion LFI vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization,...

CVE-2026-7817: Files or Directories Accessible to External Parties

Local file inclusion LFI and server-side request forgery SSRF vulnerabilities in pgAdmin 4 LLM API configuration endpoints. User-supplied apikeyfile and apiurl preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by...

ffensive-playbook

HackTheBox — Writeups Collection A collection of HackTheBox m...

ofensive-playbook

HackTheBox — Writeups Collection A collection of HackTheBox m...

CVE-2026-34036: Improper Control of Filename for Include/Require Statement in PHP Program

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. In versions 22.0.4 and prior, there is a Local File Inclusion LFI vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting...

CVE-2026-22502: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Mr. Cobbler mr-cobbler allows PHP Local File Inclusion.This issue affects Mr. Cobbler: from n/a through = 1.1.9...

CVE-2026-29858: Improper Control of Filename for Include/Require Statement in PHP Program

A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion LFI, leadingot sensitive information exposure...

CVE-2026-29522: Improper Limitation of a Pathname to a Restricted Directory

ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion LFI vulnerability in the /server/nodeupgradesrv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to...

CVE-2026-28096: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through = 2.18...

CVE-2026-22412: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Eona eona allows PHP Local File Inclusion.This issue affects Eona: from n/a through = 1.3...

CVE-2026-28047: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through = 1.4.16...