Total
1353 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-20125 | 2026-10-30 | N/A | 7.5 HIGH | ||
| DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18. | |||||
| CVE-2026-62121 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | |||||
| CVE-2026-110185 | 2026-10-28 | N/A | 5.9 MEDIUM | ||
| The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case. | |||||
| CVE-2014-125137 | 2026-10-28 | N/A | 6.5 MEDIUM | ||
| C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server. | |||||
| CVE-2016-20101 | 2026-10-27 | N/A | 8.1 HIGH | ||
| Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20. | |||||
| CVE-2026-28039 | 2026-10-27 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1. | |||||
| CVE-2025-65656 | 1 Dcatadmin | 1 Dcat Admin | 2026-10-26 | N/A | 9.8 CRITICAL |
| dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. | |||||
| CVE-2026-30480 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesystem via path traversal sequences in the nfsen parameter. | |||||
| CVE-2026-22338 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. | |||||
| CVE-2026-40721 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. | |||||
| CVE-2026-48972 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5. | |||||
| CVE-2026-39523 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. | |||||
| CVE-2026-39590 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. | |||||
| CVE-2026-39537 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. | |||||
| CVE-2026-22326 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. | |||||
| CVE-2026-54814 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109. | |||||
| CVE-2026-22330 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. | |||||
| CVE-2026-39568 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. | |||||
| CVE-2026-39522 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Solene <= 3.4 versions. | |||||
| CVE-2026-39549 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. | |||||