CVE-2026-28151High· 8.1▾ TwilightUnauthenticated Local File Inclusion in Tonda < 2.6 versions.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2017-20289High· 7.5Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
CVE-2026-112820High· 8.1WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability
CVE-2016-20101High· 8.1Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
CVE-2026-111829Medium· 6.5WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability
CVE-2025-63738Medium· 4.3An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.
CVE-2026-110284High· 7.5The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode.…