CVE-2025-39592

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through = 1.3.0...

CVE-2025-39570 WordPress WPCOM Member plugin <= 1.7.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Lomu WPCOM Member wpcom-member allows PHP Local File Inclusion.This issue affects WPCOM Member: from n/a through = 1.7.7...

CVE-2025-39584 WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through = 4.0.25...

CVE-2025-39584

CVE-2025-39584 corresponds to a WordPress Eventin vulnerability: an Authenticated Local File Inclusion via an improper filename control in the PHP include/require flow. Affected software is Eventin versions up to and including 4.0.25. The root cause is described as improper control of the filenam...

CVE-2025-39584 WordPress Eventin <= 4.0.25 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Themewinter Eventin allows PHP Local File Inclusion. This issue affects Eventin: from n/a through 4.0.25...

CVE-2025-39592

CVE-2025-39592 corresponds to a WordPress plugin vulnerability in Subscribe to Unlock Lite (WordPress plugin). The issue is described as an improper control of the filename for include/require statements, enabling a PHP Local File Inclusion via a Local File Inclusion vulnerability in WP Shuffle S...

CVE-2024-40071

The Sourcecodester Online ID Generator System 1.0 is vulnerable to an arbitrary file upload vulnerability located at the id_generator/classes/SystemSettings.php?f=update_settings endpoint. This flaw allows an attacker to upload a crafted PHP file , leading to arbitrary code execution on the targe...

PT-2025-16610 · Eventin · Eventin

Name of the Vulnerable Software and Affected Versions: Eventin versions n/a through 4.0.25 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local File Inclusion. Recommendation...

CVE-2025-27011

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Booking and Rental Manager: from n/a throu...

CVE-2025-27011 WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Booking and Rental Manager: from n/a throu...

CVE-2025-27011 WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows PHP Local File Inclusion.This issue affects Booking and Rental Manager: from n/a throu...

CVE-2025-27011

CVE-2025-27011 describes an authenticated (Contributor+) Local File Inclusion in the Booking and Rental Manager plugin for MagePeopleTeam WordPress, arising from improper control of filenames in include/require statements, enabling local file inclusion via PHP. The issue affects Booking and Renta...

CVE-2025-26894

CVE-2025-26894 : NotFound Coming Soon, Maintenance Mode plugin is affected by an unauthenticated Local File Inclusion (LFI) due to improper control of filename in PHP include/require, impacting versions from n/a through 1.1.1. Connect docs confirm the issue and affected product as Coming Soon, Ma...

CVE-2025-26894 WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mobeen Abdullah Coming Soon, Maintenance Mode site-mode allows PHP Local File Inclusion.This issue affects Coming Soon, Maintenance Mode: from n/a through = 1.1.1...

CVE-2025-26889

CVE-2025-26889 is a Local File Inclusion vulnerability in the WordPress plugin hockeydata LOS (notFound hockeydata LOS) affecting versions

CVE-2025-26894 WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mobeen Abdullah Coming Soon, Maintenance Mode site-mode allows PHP Local File Inclusion.This issue affects Coming Soon, Maintenance Mode: from n/a through = 1.1.1...

RHEL 6 / 7 : rh-php56-php (RHSA-2016:1612)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1612 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: It was discovered that PHP did not properly...

PT-2025-16316 · Unknown · Hockeydata Los

Name of the Vulnerable Software and Affected Versions: hockeydata LOS versions 1.2.4 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

BIT-PHP-MIN-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the...

BIT-PHP-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the...