VulnSea

CWE-98

CVEs classified under CWE-98, newest first.

266 CVEsRSS

CVE-2026-110185Medium· 5.9
today

Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field r…

▾ Sunlitbitpressadmin · Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and Morevia CVEORG
CVE-2014-125137Medium· 6.5
today

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traver…

▾ SunlitC97net · qEngine CMSvia CVEORG
CVE-2026-112850High· 8.1
5d ago

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1…

▾ TwilightAncoraThemes · your-dressEPSS 0.34%via CVEORG
CVE-2017-20289High· 7.5PoC
6d ago

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/inde…

▾ MidnightBroadstreet · Ad WidgetEPSS 0.93%via CVEORG
CVE-2026-112832Critical· 9.8
6d ago

WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

▾ MidnightCozyThemes · rootbloxEPSS 0.44%via CVEORG
CVE-2026-112820High· 8.1
6d ago

WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from …

▾ TwilightElated-Themes · academist-coreEPSS 0.44%via CVEORG
CVE-2016-20101High· 8.1PoC
1w ago

Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/doc…

▾ MidnightPedro Marcelo · Issuu PanelEPSS 0.40%via CVEORG
CVE-2026-113402Medium· 6.5
1w ago

ArmorX Global Technology｜ArmorX Spam - Local File Inclusion

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

▾ SunlitArmorX Global Technology · ArmorX SpamEPSS 0.38%via CVEORG
CVE-2026-111829Medium· 6.5
1w ago

WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through…

▾ SunlitWP Mailster · wp-mailsterEPSS 0.32%via CVEORG
CVE-2026-62858Medium· 5.3PoC
2w ago

YOURLS is a self-hosted, customizable URL shortener written in PHP

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash tra…

▾ TwilightYOURLS · YOURLSEPSS 0.47%via NVD
CVE-2026-110284High· 7.5
2w ago

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode.…

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode.…

▾ Twilightlifterlms · LifterLMS – WP LMS for eLearning, Online Courses, & QuizzesEPSS 0.67%via NVD
CVE-2026-104909High· 8.1
2w ago

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to incl…

▾ Twilightkitae-park · Mang BoardEPSS 1.0%via NVD
CVE-2026-103367High· 8.1
2w ago

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for un…

▾ Twilightwpdesk · ShopMagic – email automation for WordPressEPSS 1.0%via NVD
CVE-2026-104995High· 8.1
2w ago

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX director…

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX director…

▾ Twilightdontdream · BP Profile SearchEPSS 1.1%via NVD
CVE-2026-66566High· 8.1
2w ago

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

▾ TwilightElated-Themes · AmbientEPSS 0.27%via NVD
CVE-2026-62115High· 8.1
2w ago

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

▾ Twilightkutethemes · KuteShopEPSS 0.27%via NVD
CVE-2026-62099High· 8.1
2w ago

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

▾ Twilightkutethemes · BoutiqueEPSS 0.27%via NVD
CVE-2026-62096High· 8.1
2w ago

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

▾ Twilightkutethemes · BiolifeEPSS 0.27%via NVD
CVE-2026-62094High· 8.1
2w ago

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

▾ Twilightkutethemes · TechOneEPSS 0.27%via NVD
CVE-2026-62092High· 8.1
2w ago

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

▾ Twilightkutethemes · ArmaniaEPSS 0.27%via NVD
CVE-2026-62075High· 8.1
2w ago

Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

▾ TwilightMymoun · BackhoeEPSS 0.34%via NVD
CVE-2026-62074High· 8.1
2w ago

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

▾ TwilightThemeREX · OzeumEPSS 0.34%via NVD
CVE-2026-62070High· 8.1
2w ago

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

▾ TwilightCKThemes · FlipmartEPSS 0.34%via NVD
CVE-2026-62069High· 8.1
2w ago

Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

▾ TwilightCocoBasic · FabiusEPSS 0.34%via NVD
CVE-2026-62068High· 8.1
2w ago

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

▾ TwilightCocoBasic · TeoroEPSS 0.34%via NVD
CVE-2026-62067High· 8.1
2w ago

Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

▾ TwilightCocoBasic · KavenEPSS 0.34%via NVD
CVE-2026-62066High· 8.1
2w ago

Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

▾ TwilightCocoBasic · VolosEPSS 0.34%via NVD
CVE-2026-62065High· 8.1
2w ago

Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

▾ TwilightCocoBasic · CardeaEPSS 0.34%via NVD
CVE-2026-62032Critical· 9.8
2w ago

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

▾ MidnightDesigninvento · directorypressEPSS 0.34%via NVD
CVE-2026-62020High· 8.1
2w ago

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

▾ TwilightMikado-Themes · TouchUpEPSS 0.34%via NVD
CWE-98 vulnerabilities (CVEs) · VulnSea