| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
| Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
| Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
| Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
| Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
| Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
| Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
| Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
| Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
| Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
| Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
| Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
| Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5. |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3. |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion.
This issue affects WP Customer Area: before 8.3.4. |
| An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themekraft BuddyForms buddyforms allows PHP Local File Inclusion.This issue affects BuddyForms: from n/a through 2.10.2. |
| The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields. |
| The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. |
