CVE-2026-27555

CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Inclusion de fichier locale non authentifiée 📝 Description Le plugin Kubio AI Page Builder pour WordPress est vulnérable à une inclusion de fichier locale dans toutes les versions jusqu'à la 2.5.1 incluse, via la fonction kubiohybridthemeloadtemplate. Cela permet...

discuz-ml-rce

discuz-ml-rce Systèmes et versions concernés : Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Cause de la vulnérabilité : le système Discuz!ML ne filtre pas le contenu du paramètre language reçu via le cookie l, ce qui entraîne une concaténation de chaînes et permet d'exécuter du code PHP. Un champ...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 Exploit entièrement automatisé pour CVE-2024-25641. Lorsqu'un utilisateur est authentifié, Cacti version 1.2.26 est vulnérable à une vulnérabilité d'écriture de fichier arbitraire, exploitable via la fonctionnalité « Package Import », permet aux...

RCE_CVE-2024-7954-

RCECVE-2024-7954- The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. CRITICAL Exploit: POST...

CVE-2021-44967

CVE-2021-44967 root@kitploit: Exploit Title: LimeSurvey 5.2.4 - Exécution de code à distance authentifiée RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Découvert par: Y1LD1R1M Auteur de l'exploit: D3Ext Page d'accueil du fournisseur:...

CVE-2024-25641

CVE-2024-25641 RCE for Cacti 1.2.26 This repository automates the process of exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates"...

CVE-2018-16370

CVE-2018-16370 Dans PESCMS Team 2.2.1, les attaquants peuvent télécharger et exécuter du code PHP arbitraire via /Public/?g=Team&m=Setting&a=upgrade en plaçant un fichier .php dans une archive ZIP.Plus de détails voir https://github.com/lazyphp/PESCMS-TEAM/issues/2...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2017-9841-EXPLOIT

CVE-2017-9841 - Удаленное выполнение кода RCE в PHPUnit Эта уязвимость затрагивает версии PHPUnit до 4.8.28, а также все версии 5.x до 5.6.3. Она позволяет злоумышленникам выполнять произвольный PHP-код на серверах, где PHPUnit доступен извне. Проблема заключается в файле eval-stdin.php,...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

EUVD-2026-76829

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200

GEO my WP is a WordPress plugin vulnerable to an unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.5.5.3 , via the gmw_posts_locator_ajax_info_window_loader function. An attacker can include and execute arbitrary .php files on the server, enabling bypass of access c...

CVE-2026-84063

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

EUVD-2026-75229

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

CVE-2026-84063

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

Multiple vulnerabilities in baserCMS plugin "BurgerEditor"

Overview baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below: Authorization Bypass Through User-Controlled Key CWE-639 - CVE-2026-84062 Unrestricted Upload of File with Dangerous Type CWE-434 - CVE-2026-84063 Kuniyoshi Noguchi @KuniNogu report...

CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15667 Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is affected by a Local File Inclusion vulnerability in all versions up to and including 4.1.22 , exploitable via the event_layout parameter. Because the etn_manage_event capability is assigned to...