9925 matches found
CVE-2025-64356
The CVE-2025-64356 case concerns the WordPress Insert PHP Code Snippet plugin (insert-php-code-snippet) with versions up to 1.4.3. The root cause is a missing/incorrect authorization (broken access control) vulnerability that could allow unauthorized access due to misconfigured access control sec...
CVE-2025-64356: Missing Authorization
Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a through = 1.4.3...
CVE-2025-64216
CVE-2025-64216 is a Local File Inclusion vulnerability in WordPress theme SmartMag (versions
EUVD-2025-36538
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...
PT-2025-44188
Name of the Vulnerable Software and Affected Versions alexusmai laravel-file-manager versions prior to 3.3.2 Description An authenticated attacker can achieve Remote Code Execution RCE through a two-step process involving a crafted file upload. First, a file with a .png extension containing PHP...
CVE-2025-56399
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...
CVE-2025-32283
CVE-2025-32283 : WordPress Solar Energy theme (
PT-2025-42787
Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.2 147 Description ClipBucket v5 is an open source video sharing platform susceptible to arbitrary PHP code execution. The type parameter within a POST request to the /upload/admin area/actions/update launch.php...
CVE-2025-62429: Improper Control of Generation of Code
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/adminarea/actions/updatelaunch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is n...
CVE-2025-57567
A remote code execution RCE vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory /themes/defaut/css/minify.php. An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel,...
PT-2025-43352
Name of the Vulnerable Software and Affected Versions Houzez Theme - Functionality versions prior to 4.1.9 Description The Houzez Theme - Functionality plugin for WordPress contains a Local File Inclusion issue. This allows authenticated attackers with contributor-level access or higher to includ...
EUVD-2025-34556
The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
CVE-2025-11746
CVE-2025-11746 is an authenticated Local File Inclusion vulnerability affecting the WordPress XStore/Multi-purpose WooCommerce Theme (versions <= 9.5.4). Exploitation via theet_ajax_required_plugins_popup() enables an attacker with Subscriber+ privileges to include and execute arbitrary PHP co...
WordPress plugin XStore 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A path travers...
CVE-2025-7634
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on th...
CVE-2025-7634 WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on th...
EUVD-2015-5594
Malware in sbrugna...
EUVD-2015-6900
Malware in sbrugna...