Skip to content
Threat Feed
Subscribe

Tag

File-Inclusion

3 briefs RSS
high advisory

Yii 2 Local File Inclusion via View Parameter Name Collision (CVE-2026-39850)

A local file inclusion vulnerability (CVE-2026-39850) exists in Yii 2 versions prior to 2.0.55 due to the `View::renderPhpFile()` method's handling of the `_file_` parameter, allowing attackers to read arbitrary files and potentially achieve remote code execution if they can write PHP files.

yii2 lfi file-inclusion php cloud
2r 1t
high advisory

SourceCodester Leave Application System 1.0 File Inclusion Vulnerability (CVE-2026-5210)

SourceCodester Leave Application System 1.0 is vulnerable to remote file inclusion (CVE-2026-5210) due to improper handling of the 'page' argument, potentially allowing attackers to execute arbitrary code.

cve-2026-5210 file-inclusion web-application
2r 1t 1c 1i
high advisory

SmarterTools SmarterMail Local File Inclusion Vulnerability (CVE-2026-7807)

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint (CVE-2026-7807) that allows authenticated users to read arbitrary .json files, potentially leading to credential compromise.

SmarterMail lfi file-inclusion credential-access
2r 1t 1c