Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,358

Export CSV
CVE-2026-41228

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not validate the `def_language` parameter against the list of available language files. An authenticated customer can set `def_language` to a path traversal payload (e.g., `../../../../../var/customers/webs/customer1/evil`), which is stored in the database. On subsequent requests, `Language::loadLanguage()` constructs a file path using this value and executes it via `require`, achieving arbitrary PHP code execution as the web server user. Version 2.3.6 fixes the issue.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Froxlor
Products
Froxlor
CVE-2025-60193

WordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Premmerce Wordpress
Products
User Roles Wordpress
CVE-2025-62075

WordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-62055

WordPress Academist theme < 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Elated-themes Wordpress
Products
Academist Wordpress
CVE-2025-62045

WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Codexthemes Wordpress
Products
Thegem Wordpress
CVE-2025-60194

WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Premmerce Wordpress
Products
Product Search For Woocommerce Wordpress
CVE-2025-60197

WordPress Simple Contact Forms plugin <= 1.6.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows PHP Local File Inclusion.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Owenr88 Wordpress
Products
Simple Contact Forms Wordpress
CVE-2025-60199

WordPress InHype - Blog & Magazine WordPress Theme theme <= 1.5.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx InHype - Blog & Magazine WordPress Theme inhype allows PHP Local File Inclusion.This issue affects InHype - Blog & Magazine WordPress Theme: from n/a through <= 1.5.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Dedalx Wordpress
Products
Inhype Wordpress
CVE-2025-60200

WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows PHP Local File Inclusion.This issue affects LearnPress Export Import: from n/a through <= 4.1.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress
Products
Learnpress Export Import Wordpress
CVE-2025-60203

WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through <= 2.7.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60204

WordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Josh Kohlbach Woocommerce Wordpress
Products
Woocommerce Store Toolkit Woocommerce Wordpress
CVE-2025-60063

WordPress Rosalinda theme <= 1.2.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Rosalinda rosalinda allows PHP Local File Inclusion.This issue affects Rosalinda: from n/a through <= 1.2.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress
Products
Rosalinda Wordpress
CVE-2025-68066

WordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through <= 8.7.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Pencidesign Wordpress
Products
Soledad Wordpress
CVE-2025-63003

WordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North - Required Plugin north-plugin allows PHP Local File Inclusion.This issue affects North - Required Plugin: from n/a through <= 1.4.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-63074

WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dream-theme Wordpress
Products
The7 Wordpress
CVE-2025-68062

WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Thememove Wordpress
Products
Minimogwp Wordpress
CVE-2025-68068

WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through <= 9.14.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Select-themes Wordpress
Products
Stockholm Wordpress
CVE-2025-49363

WordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Kings & Queens kings-queens allows PHP Local File Inclusion.This issue affects Kings & Queens: from n/a through <= 1.1.16.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-49364

WordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ludos Paradise ludos-paradise allows PHP Local File Inclusion.This issue affects Ludos Paradise: from n/a through <= 2.1.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60196

WordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calculator clearblue-ovulation-calculator allows PHP Local File Inclusion.This issue affects Clearblue® Ovulation Calculator: from n/a through <= 1.2.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress