21024 matches found
CVE-2026-79773
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
CVE-2026-79773
Winter CMS before 1.2.13 is affected by a local file inclusion vulnerability in the JavascriptImporter filter . Authenticated users holding the cms.manage_assets permission can embed =include or =require directives in theme JavaScript assets, referencing files outside the theme directory (e.g., ....
EUVD-2026-65531
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
CVE-2026-79773 Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...
CVE-2026-78566
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-78566
CVE-2026-78566 covers a Local File Inclusion (LFI) vulnerability in the Shuffle theme for WordPress , affecting all versions up to and including 1.8 . Unauthenticated attackers can include and execute arbitrary files on the server, enabling execution of any PHP code within those files. This can b...
EUVD-2026-65326
The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...
CVE-2026-78566
...
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by G0053 in WordPress Theme CozyStay versions = 1.10.0...
CVE-2026-78477
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-78478
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...
EUVD-2026-65300
The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...
CVE-2026-78477
CVE-2026-78477 was rejected (issued in error) in the initial NVD entry, but connected records provide concrete technical details. The Jawn theme for WordPress contains a privilege escalation vulnerability in all versions up to and including 1.4.2 , allowing unauthenticated attackers to elevate th...
CVE-2026-78478
The Måne theme for WordPress is affected by an unauthenticated Local File Inclusion vulnerability in all versions up to and including 1.7 . An attacker can include and execute arbitrary files on the server, enabling execution of any PHP code within those files. This can be leveraged to bypass acc...
CVE-2026-78478 Måne <= 1.7 - Unauthenticated Local File Inclusion
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...
EUVD-2026-65303
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypas...