Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2025-32309

WordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP Local File Inclusion.This issue affects Healsoul: from n/a through <= 2.2.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thememove
Products
Healsoul
CVE-2025-59564

WordPress EduMall Theme < 4.4.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thememove Wordpress
Products
Edumall Wordpress
CVE-2025-59558

WordPress Billey Theme < 2.1.6 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thememove Wordpress
Products
Billey Wordpress
CVE-2025-59555

WordPress Medizin Theme < 1.9.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thememove Wordpress
Products
Medizin Wordpress
CVE-2021-24950

Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thememove
Products
Insight Core