4738 matches found
CVE-2025-28916 WordPress Docpro plugin <= 2.0.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through = 2.0.1...
CVE-2025-24690 WordPress Formality Plugin <= 1.5.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through = 1.5.7...
CVE-2025-24690
CVE-2025-24690: Local File Inclusion in the WordPress Formality plugin ( 1.5.7) per vulnerability records; CVSS v3.1 base score 8.1 (high). Exploitation status not detailed in provided documents.
CVE-2025-23937 WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Alex Furr LinkedIn Lite linkedin-lite allows PHP Local File Inclusion.This issue affects LinkedIn Lite: from n/a through = 1.0...
RHEL 8 : php:7.4 (RHSA-2025:3016)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3016 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: Use after free due to phpfilterfloat faili...
RHEL 8 : php:7.4 (RHSA-2025:3076)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3076 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: Use after free due to phpfilterfloat faili...
Hackers Exploit Severe PHP Flaw to Deploy Quasar RAT and XMRig Miners
Threat actors are exploiting a severe security flaw in PHP to deliver cryptocurrency miners and remote access trojans RATs like Quasar RAT. The vulnerability, assigned the CVE identifier CVE-2024-4577, refers to an argument injection vulnerability in PHP affecting Windows-based systems running in...
php: Use after free due to php_filter_float() failing for ints
A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leading to a crash or a Segmentation fault...
PT-2025-11313 · Php +7 · Php +7
Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: A severe issue was disclosed for PHP. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...
Exploit for Cross-site Scripting in Rafed-System Rafed_Cms_Website
CVE-2024-55060 Rafed CMS Website v1.44 - Cross Site Scripting...
CVE-2025-26916
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through = 8.2...
Wp2Fac 1.0 Code Injection
Wp2Fac version 1.0 proof of concept code injection exploit that takes advantage of a flaw originally discovered by Ahmet Ümit Bayram in 2023. ============================================================================================================================================= | Title :...
CVE-2025-26916
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through = 8.2...
CVE-2025-26916
CVE-2025-26916 corresponds to an Unauthenticated Local File Inclusion in WordPress Massive Dynamic (theme) up to version 8.2. The issue is described as improper control of the filename used by PHP include/require, enabling local file inclusion via network access. Public sources in the connected d...
CVE-2025-26933
CVE-2025-26933 describes a Local File Inclusion in the WordPress plugin “WC Place Order Without Payment” (WooCommerce). Affected: WC Place Order Without Payment
CVE-2025-26916 WordPress Massive Dynamic theme <= 8.2 - Unauthenticated Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through = 8.2...
CVE-2025-2036 s-a-zhd Ecommerce-Website-using-PHP details.php sql injection
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php. The manipulation of the argument proid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2025-2035
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /customerregister.php. The manipulation of the argument name leads to unrestricted upload. The attack may be launched remotely. The...
CVE-2025-23945
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Webliup Popliup popliup allows PHP Local File Inclusion.This issue affects Popliup: from n/a through = 1.1.1...