CVE-2022-34121

Cuppa CMS v1.0 was discovered to contain a local file inclusion LFI vulnerability via the component /templates/default/html/windows/right.php...

CVE-2022-34121

Cuppa CMS v1.0 is vulnerable to a local file inclusion (LFI) through the component /templates/default/html/windows/right.php . The issue, described across sources, enables unauthorized access and disclosure of sensitive information, with potential remote code execution implied by some references....

Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file Direct call:...

8x8: LFI via Jolokia at https://█.█.█.█:1293

@shuvam321 reported to us a single exposed host in the acceptance environment. The report demonstrated a Local File Inclusion via Jolokia, e.g.: https://█.█.█.█:1293/actuator/jolokia/exec/com.sun.management:type=DiagnosticCommand/compilerDirectivesAdd/!/etc!/hostname No sensitive information has...

CVE-2022-32409

The Portal do Software Publico Brasileiro i3geo v7.0.5 is vulnerable to a Local File Inclusion (LFI) vulnerability in the codemirror.php component. An attacker can exploit this by sending a crafted HTTP request to execute arbitrary PHP code , potentially allowing access to sensitive information s...

LFI / Path Traversal allows attacker to read any file in the working directory

Description The file upload functionality allows a user to attach a file to a paste. When an attacker views the attached file he can alter the path e.g. via burpsuit and read any file in the working directory via the relative path. This also accounts for private pastes. The attacker needs...

WS-2022-0187

LFI / Path Traversal allows attacker to read any file in the working directory in szabodanika/microbin prior to 1.1.0...

CVE-2022-32409: Improper Limitation of a Pathname to a Restricted Directory

A local file inclusion LFI vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request...

WordPress CAPTCHA 4WP plugin <= 7.0.6.1 - Local File Inclusion (LFI) via Cross-Site Request Forgery (CSRF) vulnerability

Local File Inclusion LFI via Cross-Site Request Forgery CSRF vulnerability was discovered by ZhongFu Su JrXnm in the WordPress CAPTCHA 4WP plugin versions = 7.0.6.1. Solution Update the WordPress CAPTCHA 4WP plugin to the latest available version at least 7.1.0...

CVE-2022-23167

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

CVE-2022-23167: Undefined Security Weakness

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

CVE-2022-29597

CVE-2022-29597 affects Solutions Atlantic Regulatory Reporting System (RRS) v500. It exposes a Local File Inclusion (LFI) vulnerability via the ShowDocument/ShowDocument.aspx page, where an authenticated user can abuse the fileName parameter to reference internal system files (eg. web.config) and...

CVE-2022-29597: Improper Limitation of a Pathname to a Restricted Directory

Solutions Atlantic Regulatory Reporting System RRS v500 is vulnerable to Local File Inclusion LFI. Any authenticated user has the ability to reference internal system files within requests made to the RRSWeb/maint/ShowDocument/ShowDocument.aspx page. The server will successfully respond with the...

CVE-2021-26633 Maxboard SQL injection and LFI vulnerability

SQL injection and Local File Inclusion LFI vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file...

CVE-2021-26633

CVE-2021-26633 affects MaxBoard, a CMS/web framework. The connected sources describe a two-pronged vulnerability: SQL Injection and Local File Inclusion (LFI) in MaxBoard that can cause information leakage and privilege escalation. The root cause is manipulation of input variables to insert arbit...

CVE-2022-29447

CVE-2022-29447 concerns the WordPress Hover Effects plugin (versions

CVE-2022-29447 WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated administrator or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Hover Effects plugin = 2.1 at WordPress...

Design/Logic Flaw

Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...

CVE-2022-29448

CVE-2022-29448 describes a Local File Inclusion (LFI) vulnerability in WordPress Herd Effects plugin prior to or at version 5.2, requiring an authenticated admin or higher user to exploit. The issue stems from inadequate validation in how local file resources are selected for inclusion, allowing ...

CVE-2022-29448: Use of Incorrectly-Resolved Name or Reference

Authenticated admin or higher user role Local File Inclusion LFI vulnerability in Wow-Company's Herd Effects plugin = 5.2 at WordPress...