CVE-2026-115396

Ghidra versions 10.3 before 12.2 are vulnerable to an improper handling of highly compressed data (CWE-409) within the ThemeReader.processIconFile() function. The root cause is a failure to limit the decompressed size or compression ratio of data. An attacker can trick a user into importing a cra...

CVE-2026-115396 Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesyste...

CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...

EUVD-2021-34900

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the stylename parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/?op=theme with ../ sequences in stylename to read local files such as /etc/passwd...

EUVD-2017-19024

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...

CVE-2017-20287

The Javo Spot theme for WordPress (versions before 3.0.0 ) is vulnerable to a path traversal flaw. This vulnerability exists in the jvfrm_spot_get_json AJAX action, where an unauthenticated attacker can use the fn parameter to read arbitrary files. Specifically, by sending a GET request to /wp-ad...

CVE-2025-69080

Gecko Theme LFI Exploit CVE-2025-69080 Unauthenticated Local File Inclusion LFI vulnerability in WordPress Gecko Theme = 1.9.8 ⚠️ Description This exploit targets a high-severity CVSS 8.1 Local File Inclusion vulnerability in the JanStudio Gecko WordPress theme. The vulnerability allows an...

WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery

WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can...

VulnCheck KEV: CVE-2021-48017

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the stylename parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/?op=theme with ../ sequences in stylename to read local files such as /etc/passwd...

WG-CVE-2026-1555-Linux

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ╚═════╝ ╚═══╝...

DRUPAL-CONTRIB-2026-224

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Vagabonds versions = 1.3.10...

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Rhodos versions = 1.3.3...

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Little Birdies versions = 1.3.16...

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

PT-2026-120900

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...

Linux Distros Unpatched Vulnerability : CVE-2026-17025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versio...

PT-2026-120908

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

Exploit for CVE-2026-64638

██╗ ██╗███████╗███████╗██████╗ ███████╗██╗ ██╗███████╗██╗...

CVE-2014-125133

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...