CVE-2025-47440

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Greg Winiarski WPAdverts wpadverts allows PHP Local File Inclusion.This issue affects WPAdverts: from n/a through = 2.2.2...

CVE-2025-47439

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through = 5.0.22...

CVE-2025-47653

CVE-2025-47653 refers to a PHP Local File Inclusion in the WordPress WP-Recall plugin (versions up to and including 16.26.14) caused by improper filename handling. The vulnerability is characterized in sources as a local file inclusion risk arising from PHP Remote File Inclusion concepts, with a ...

CVE-2025-47531 WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

CVE-2025-47531

CVE-2025-47531 applies to the WordPress plugin “XT Event Widget for Social Events” (Xylus Themes). The issue is an improper control of filename for include/require statements, enabling Local File Inclusion. Affected versions are up to 1.1.7; exploitation context is limited to LFI within the plugi...

CVE-2025-47498

CVE-2025-47498 affects WordPress Hotel Booking (Hotel Booking plugin) versions n/a through 3.6 and is a Local File Inclusion due to improper filename control in PHP include/require statements. The CVSS v3.1 base score is 7.5 (HIGH) with network, high exploit complexity, low privileges, and no use...

CVE-2025-47496 WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through = 4.7.5...

CVE-2025-47496

CVE-2025-47496 : WordPress plugin PublishPress Authors (

CVE-2025-47494 WordPress EventON <= 2.4.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashan Perera EventON allows PHP Local File Inclusion. This issue affects EventON: from n/a through 2.4.1...

CVE-2025-47440 WordPress WPAdverts plugin <= 2.2.2 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Greg Winiarski WPAdverts wpadverts allows PHP Local File Inclusion.This issue affects WPAdverts: from n/a through = 2.2.2...

CVE-2025-47440

CVE-2025-47440 affects WPAdverts versions up to 2.2.2 and is described as an improper control of filename for include/require in PHP, i.e., a Local File Inclusion in the PHP program. The provided documents indicate a local file inclusion vulnerability with an active product (WPAdverts) and list a...

CVE-2025-47439 WordPress Download Monitor plugin <= 5.0.22 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through = 5.0.22...

CVE-2025-46550

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the /?BazaR endpoint and idformulaire parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link...

CVE-2025-46337

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and...

CVE-2025-46348

YesWiki prior to 4.5.4 allows unauthenticated backups via the archives API, enabling archive creation and download with predictable filenames. This undermines authentication, exposes potentially sensitive site data, and can enable DoS by mass archive creation. The issue has been fixed in version ...

PT-2025-29479 · Gnu · Snappy

Уязвимость библиотеки PHP Snappy связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить SSRF-атаку путем отправки специально созданного HTTP-запроса...

php: Stream HTTP wrapper truncates redirect location to 1024 bytes

A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size...

CVE-2025-32921

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through = 1.4.5...

CVE-2025-46230

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through = 1.1.35...

CVE-2025-39387

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpoperations Opstore opstore allows PHP Local File Inclusion.This issue affects Opstore: from n/a through = 1.4.5...