PT-2025-29378

Name of the Vulnerable Software and Affected Versions Tanium Comply affected versions not specified PHP versions 8.8.4.10.1.1 Description Tanium Comply had an issue with incorrect default permissions. A remote code execution issue exists in PHP version 8.8.4.10.1.1. Recommendations At the moment,...

php8-8.4.10-1.1 on GA media (moderate)

php8-8.4.10-1.1 on GA media Announcement ID: openSUSE-SU-2025:15340-1 Rating: moderate Cross-References: CVE-2025-1220 CVE-2025-1735 CVE-2025-6491 CVSS scores: CVE-2025-1220 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-1220 SUSE : 9.1...

OESA-2025-1762 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

FreeBSD : php -- Multiple vulnerabilities (d607b12c-5821-11f0-ab92-f02f7497ecda)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d607b12c-5821-11f0-ab92-f02f7497ecda advisory. php.net reports: Tenable has extracted the preceding description block directly from the FreeB...

CVE-2025-30992 WordPress Puca theme <= 2.6.33 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through = 2.6.33...

CVE-2025-32298

CVE-2025-32298 concerns the WordPress CTUsers plugin (versions through 1.0.0). The vulnerability is an improper control of the filename used with include/require, i.e., a PHP Remote File Inclusion that enables PHP Local File Inclusion. The issue affects CTUsers up to 1.0.0 and is categorized with...

CVE-2025-52826 WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3...

PT-2025-27123 · Unknown · Thembay Diza

Name of the Vulnerable Software and Affected Versions: thembay Diza versions 1.3.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This ...

CVE-2021-4457 ZoomSounds < 6.05 - Unauthenticated Arbitrary File Upload

The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server...

CVE-2025-52715

Affected software: WordPress Classified Listing plugin (WordPress Classified Listing) versions ≤ 4.2.0. Vulnerability: Local File Inclusion (PHP Remote File Inclusion) due to Improper Control of Filename for Include/Require statements in PHP. Impact: Potential exposure of local files via crafted ...

TencentOS Server 4: php (TSSA-2025:0004)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0004 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 4: openssl (TSSA-2024:0914)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0914 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2025-24460 · WordPress · Bodycenter - Gym

Name of the Vulnerable Software and Affected Versions: BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions n/a through 2.4 Description: The issue affects the BodyCenter - Gym, Fitness WooCommerce WordPress Theme, allowing for PHP Local File Inclusion due to improper control of filename...

CVE-2025-49307 WordPress WP Multilang <= 2.4.19 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magazine3 WP Multilang allows PHP Local File Inclusion. This issue affects WP Multilang: from n/a through 2.4.19...

CVE-2025-49308 WordPress WP Travel Engine <= 6.5.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.5.1...

CVE-2025-32286 WordPress Butcher <= 2.40 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ApusTheme Butcher allows PHP Local File Inclusion. This issue affects Butcher: from n/a through 2.40...

CVE-2025-32309 WordPress Healsoul <= 2.0.2 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove Healsoul allows PHP Local File Inclusion. This issue affects Healsoul: from n/a through 2.0.2...

CVE-2024-52385

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpmart Team Member team-showcase-supreme.This issue affects Team Member: from n/a through = 7.4...

CVE-2024-51754

Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...

CVE-2023-37260

league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException...