Advisories · Weakness

File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2024-8392 CVE record

CVSS 7.2 High

WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion
- delabon WordPress Post Grid Layouts with Pagination – Sogrid
- File inclusion
Not analysed yet 26 Oct 2024
CVE-2024-49690 CVE record

CVSS 7.5 High

WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability
- Qode Qi Blocks
- File inclusion
Not analysed yet 23 Oct 2024
CVE-2024-49701 CVE record

CVSS 7.5 High

WordPress Mags theme <= 1.1.6 - Local File Inclusion vulnerability
- themehorse Mags
- File inclusion
Not analysed yet 23 Oct 2024
CVE-2024-49243 CVE record

CVSS 7.5 High

WordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerability
- ramjon27 Dynamic Elementor Addons
- File inclusion
Not analysed yet 18 Oct 2024
CVE-2024-49317 CVE record

CVSS 7.5 High

WordPress Point Maker plugin <= 0.1.4 - Local File Inclusion vulnerability
- ZIPANG Point Maker
- File inclusion
Not analysed yet 17 Oct 2024
CVE-2024-48029 CVE record

CVSS 7.5 High

WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability
- Hung Trang Si SB Random Posts Widget
- File inclusion
Not analysed yet 16 Oct 2024
CVE-2024-49251 CVE record

CVSS 7.5 High

WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerability
- Acnoo Maan Addons For Elementor
- File inclusion
Not analysed yet 16 Oct 2024
CVE-2024-9981 CVE record

CVSS 8.8 High

FormosaSoft ee-class - Local File Inclusion
- FormosaSoft ee-class
- File inclusion
Not analysed yet 15 Oct 2024
CVE-2024-47323 CVE record

CVSS 8.1 High

WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability
- Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin
- File inclusion
Not analysed yet 5 Oct 2024
CVE-2024-44023 CVE record

CVSS 8.1 High

WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerability
- ABCApp Creator
- File inclusion
Not analysed yet 5 Oct 2024
CVE-2024-41925 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
- Optigo Networks ONS-S8 Spectra Aggregation Switch
- File inclusion
Not analysed yet 3 Oct 2024
CVE-2024-44048 CVE record

CVSS 6.5 Medium

WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability
- wpWax Product Carousel Slider & Grid Ultimate for WooCommerce
- File inclusion
Not analysed yet 23 Sept 2024
CVE-2024-8252 CVE record

CVSS 8.8 High

Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
- hornero Clean Login
- File inclusion
Not analysed yet 30 Aug 2024
CVE-2024-5762 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability
- Zen Cart
- File inclusion
Not analysed yet 21 Aug 2024
CVE-2024-43261 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability
- Hamed Naderfar Compute Links
- File inclusion
Not analysed yet 19 Aug 2024
CVE-2024-4359 CVE record

CVSS 6.5 Medium

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
- bdthemes Element Pack – Widgets, Templates & Addons for Elementor
- File inclusion
Not analysed yet 9 Aug 2024
CVE-2024-6589 CVE record

CVSS 8.8 High

LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- File inclusion
Not analysed yet 25 Jul 2024
CVE-2024-21687 CVE record

CVSS 8.1 High

PHP file inclusion in Atlassian Bamboo Data Center and others
- Atlassian Bamboo Data Center
- Atlassian Bamboo Server
- File inclusion
Not analysed yet 16 Jul 2024
CVE-2024-38735 CVE record

CVSS 7.5 High

WordPress Event post plugin <= 5.9.5 - Local File Inclusion vulnerability
- Bastien Ho Event post
- File inclusion
Not analysed yet 12 Jul 2024
CVE-2024-37520 CVE record

CVSS 6.5 Medium

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability
- RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons
- File inclusion
Not analysed yet 9 Jul 2024
CVE-2024-37410 CVE record

CVSS 4.9 Medium

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.3 - Local File Inclusion vulnerability
- IdeaBox Creations PowerPack Lite for Beaver Builder
- File inclusion
Not analysed yet 9 Jul 2024
CVE-2024-37479 CVE record

CVSS 8.5 High

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability
- LA-Studio Element Kit for Elementor
- File inclusion
Not analysed yet 2 Jul 2024
CVE-2024-5431 CVE record

CVSS 8.8 High

WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode
- arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
- File inclusion
Not analysed yet 25 Jun 2024
CVE-2024-5455 CVE record

CVSS 8.8 High

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion
- posimyththemes The Plus Addons for Elementor Page Builder Pro
- File inclusion
Not analysed yet 21 Jun 2024
CVE-2024-5503 CVE record

CVSS 8.8 High

WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion
- codevibrant WP Blog Post Layouts
- File inclusion
Not analysed yet 21 Jun 2024
CVE-2024-5574 CVE record

CVSS 7.5 High

WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
- codevibrant WP Magazine Modules Lite
- File inclusion
Not analysed yet 19 Jun 2024
CVE-2024-4551 CVE record

CVSS 6.4 Medium

Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode
- Video Gallery – YouTube Playlist, Channel Gallery by YotuWP
- File inclusion
Not analysed yet 15 Jun 2024
CVE-2024-4258 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion
- Video Gallery – YouTube Playlist, Channel Gallery by YotuWP
- File inclusion
Not analysed yet 15 Jun 2024
CVE-2024-3813 CVE record

CVSS 8.8 High

tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- tagDiv Composer
- File inclusion
Not analysed yet 15 Jun 2024
CVE-2024-5577 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion
- mcnardelli Where I Was, Where I Will Be
- File inclusion
Not analysed yet 14 Jun 2024
CVE-2024-4936 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Canto <= 3.0.8 - Unauthenticated Remote File Inclusion
- Canto
- File inclusion
Not analysed yet 14 Jun 2024
CVE-2024-36415 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
- salesagility SuiteCRM
- File inclusion
- Unrestricted file upload
Not analysed yet 10 Jun 2024
CVE-2024-35650 CVE record

CVSS 4.9 Medium

WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability
- MelaPress Login Security
- File inclusion
Not analysed yet 10 Jun 2024
CVE-2024-4887 CVE record

CVSS 7.5 High

Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion
- qodeinteractive Qi Addons For Elementor
- File inclusion
Not analysed yet 7 Jun 2024
CVE-2024-35629 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability
- Wow-Company Easy Digital Downloads – Recent Purchases
- File inclusion
Not analysed yet 4 Jun 2024
CVE-2024-36569 CVE record

CVSS 8.1 High

Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.
- File inclusion
Not analysed yet 3 Jun 2024
CVE-2024-5348 CVE record

CVSS 8.8 High

Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes
- nicdark Elements For Elementor
- File inclusion
Not analysed yet 1 Jun 2024
CVE-2024-3564 CVE record

CVSS 8.8 High

Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- vanderwijk Content Blocks (Custom Post Widget)
- File inclusion
Not analysed yet 1 Jun 2024
CVE-2024-5345 CVE record

CVSS 8.8 High

Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion
- thenahidul Responsive Owl Carousel for Elementor
- File inclusion
Not analysed yet 31 May 2024
CVE-2024-3812 CVE record

CVSS 7.5 High

Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- ThemeNectar Salient Core
- File inclusion
Not analysed yet 18 May 2024
CVE-2024-3810 CVE record

CVSS 8.8 High

Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- ThemeNectar Salient Shortcodes
- File inclusion
Not analysed yet 18 May 2024
CVE-2024-32523 CVE record

CVSS 8.1 High

WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability
- EverPress Mailster
- File inclusion
Not analysed yet 17 May 2024
CVE-2024-27971 CVE record

CVSS 8.3 High

WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability
- Premmerce Permalink Manager for WooCommerce
- File inclusion
Not analysed yet 17 May 2024
CVE-2024-3551 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion
- pencidesign Penci Soledad Data Migrator
- File inclusion
Not analysed yet 17 May 2024
CVE-2024-4670 CVE record

CVSS 8.8 High

All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode
- plugins360 All-in-One Video Gallery
- File inclusion
Not analysed yet 15 May 2024
CVE-2024-33863 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

An issue was discovered in linqi before 1.4.0.1 on Windows.
- File inclusion
Not analysed yet 14 May 2024
CVE-2024-31459 CVE record

CVSS 8.1 High

Cacti RCE vulnerability by file include in lib/plugin.php
- cacti
- File inclusion
Not analysed yet 13 May 2024
CVE-2024-3808 CVE record

CVSS 8.8 High

Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- P-THEMES Porto Theme - Functionality
- File inclusion
Not analysed yet 9 May 2024
CVE-2024-3809 CVE record

CVSS 8.8 High

Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta
- P-THEMES Porto Theme - Functionality
- File inclusion
Not analysed yet 9 May 2024
CVE-2024-3806 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
- P-THEMES Porto
- File inclusion
Not analysed yet 9 May 2024
CVE-2024-4441 CVE record

CVSS 8.1 High

XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion
- ravanh XML Sitemap & Google News
- File inclusion
Not analysed yet 9 May 2024
CVE-2024-3807 CVE record

CVSS 8.8 High

Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta
- P-THEMES Porto
- File inclusion
Not analysed yet 9 May 2024
CVE-2024-34314 CVE record

CVSS 7.5 High

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php.
- File inclusion
Not analysed yet 7 May 2024
CVE-2024-3849 CVE record

CVSS 8.8 High

Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
- Click to Chat – HoliThemes
- File inclusion
Not analysed yet 2 May 2024
CVE-2024-3500 CVE record

CVSS 8.8 High

ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets
- wpmet ElementsKit Pro
- File inclusion
Not analysed yet 2 May 2024
CVE-2024-3499 CVE record

CVSS 8.8 High

ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- File inclusion
Not analysed yet 2 May 2024
CVE-2024-1600 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Local File Inclusion in parisneo/lollms-webui
- parisneo/lollms-webui
- File inclusion
Not analysed yet 10 Apr 2024
CVE-2024-3136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- File inclusion
Not analysed yet 9 Apr 2024
CVE-2024-30849 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/products_photo.php.
- File inclusion
Not analysed yet 5 Apr 2024
CVE-2024-2047 CVE record

CVSS 8.8 High

ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- File inclusion
Not analysed yet 30 Mar 2024