Total
1353 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-69133 | 2026-10-06 | N/A | 7.5 HIGH | ||
| Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | |||||
| CVE-2025-58924 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Geya <= 1.15 versions. | |||||
| CVE-2025-69175 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions. | |||||
| CVE-2025-69112 | 2026-10-06 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. | |||||
| CVE-2026-75028 | 2026-10-06 | N/A | 7.5 HIGH | ||
| The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. | |||||
| CVE-2025-68064 | 2026-10-05 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. | |||||
| CVE-2025-58946 | 1 Axiomthemes | 1 Vocal | 2026-10-05 | N/A | 8.1 HIGH |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through <= 1.12. | |||||
| CVE-2025-58949 | 1 Axiomthemes | 1 Spock | 2026-10-05 | N/A | 8.1 HIGH |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Spock spock allows PHP Local File Inclusion.This issue affects Spock: from n/a through <= 1.17. | |||||
| CVE-2025-49359 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ShieldGroup shieldgroup allows PHP Local File Inclusion.This issue affects ShieldGroup: from n/a through <= 2.13. | |||||
| CVE-2025-60049 | 1 Axiomthemes | 1 Soleil | 2026-10-05 | N/A | 8.1 HIGH |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17. | |||||
| CVE-2025-60043 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wanderic wanderic allows PHP Local File Inclusion.This issue affects Wanderic: from n/a through <= 1.0.10. | |||||
| CVE-2025-53434 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ChildHope childhope allows PHP Local File Inclusion.This issue affects ChildHope: from n/a through <= 1.1.8. | |||||
| CVE-2025-49368 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Palladio palladio allows PHP Local File Inclusion.This issue affects Palladio: from n/a through <= 1.1.10. | |||||
| CVE-2025-49942 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Gardis gardis allows PHP Local File Inclusion.This issue affects Gardis: from n/a through <= 1.2.13. | |||||
| CVE-2025-15637 | 2026-10-05 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. | |||||
| CVE-2025-68063 | 2026-10-05 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. | |||||
| CVE-2025-58885 | 1 Ancorathemes | 1 Pathfinder | 2026-10-05 | N/A | 8.1 HIGH |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <= 1.16. | |||||
| CVE-2025-68062 | 1 Thememove | 1 Minimogwp | 2026-10-05 | N/A | 7.5 HIGH |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6. | |||||
| CVE-2026-92174 | 2026-10-03 | N/A | 7.5 HIGH | ||
| The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData payload containing a legacy top-level theme key alongside a non-empty columns array to the /wp-json/sowb/v1/widgets/previews REST endpoint, which bypasses field validation because update_fields() only processes declared form fields. | |||||
| CVE-2024-14002 | 1 Nagios | 1 Nagios Xi | 2026-10-02 | N/A | 5.5 MEDIUM |
| Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host. | |||||