cve-2026-87902-wordpress-lfi-lab

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress getpagetemplate unauthenticated LFI → conditional RCE Reproduction lab + URL-list scanner + PoC, built and validated end-to-end against genuine WordPress 7.1.1 vulnerable and 7.1.2 patched on the Docker lab. Advisory:...

WordPress Core CVE-2026-87902 Page Template LFI Detect

Detects CVE-2026-87902 in WordPress Core 4.7.0 through 7.1.1: getpagetemplate decodes pagename without validatefile, enabling unauthenticated local .php inclusion when the active theme exposes a top-level page- directory e.g. page-templates/. Fixed in 7.1.2. !/usr/bin/env python3 -- coding: utf-8...

[Full-Disclosure] Advisory: Directory traversal in CitrusDB

Advisory: Directory traversal in CitrusDB RedTeam found a directory traversal vulnerability in CitrusDB which results in inclusion of any accessible local .php file. Details ======= Product: CitrusDB Affected Version: 0.3.6, probably = 0.3.5, too Immune Version: none 2005-02-03 OS affected: all...