Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

CVE-2025-11371

CVE-2025-11371 Resumen Este repositorio contiene un exploit de prueba de concepto para CVE-2025-11371, una vulnerabilidad de Inclusión Local de Archivos LFI no autenticada en Gladinet CentreStack y TrioFox. El exploit permite la recuperación remota de archivos sensibles del sistema, como...

CVE-2026-87902

CVE-2026-87902 - Laboratorio de Validación de LFI No Autenticado → RCE en el Núcleo de WordPress Material de investigación de seguridad para reproducir y validar CVE-2026-87902 GHSA-7hp8-65ch-5whp en un laboratorio Docker aislado, solo en loopback: una inclusión local de archivos no autenticada e...

EVCer

EVCer | CVE-2023-0159 - Extensive VC Addons for WPBakery page builder Automatic Mass Tool for checking vulnerability in CVE-2023-0159 - Extensive VC Addons for WPBakery page builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

CVE-2025-2558

The The-wound WordPress theme (version 0.0.1 ) is vulnerable to an unauthenticated Local File Inclusion (LFI) attack. The root cause is the failure to properly validate certain parameters used to generate paths passed to include functions . This allows an attacker to include arbitrary local files...

CISA Warns of Critical Jenkins Vulnerability Exploited in Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a critical security flaw impacting Jenkins to its Known Exploited Vulnerabilities KEV catalog, following its exploitation in ransomware attacks. The vulnerability, tracked as CVE-2024-23897 CVSS score: 9.8, is a path travers...

CVE-2024-6459 News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI

The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files...

Exploit for Unrestricted Upload of File with Dangerous Type in Thimpress Learnpress

CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated...

CVE-2022-0320 Essential Addons for Elementor < 5.0.5 - Unauthenticated LFI

The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead ...