LFI

An unauthenticated local file inclusion vulnerability in Ziahamza webui-aria2 allows remote attackers to perform file enumeration, with publicly available proof-of-concept exploit code increasing the risk of information disclosure.

WooThemes Diarise versions through 1.5.9 are vulnerable to an arbitrary file read exploit in download.php, allowing unauthenticated attackers to retrieve sensitive system files via a crafted calendar parameter.

The Broadstreet Ad Widget WordPress plugin (versions 2.2.0 through 2.11.9) is vulnerable to authenticated local file inclusion via directory traversal in the 'step' parameter, allowing for arbitrary PHP code execution.

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.

CVE-2023-22047 allows unauthenticated attackers to perform arbitrary file reads via the wsrp-url parameter in Oracle PeopleSoft Enterprise PeopleTools.

CVE-2020-16152 is a high-severity local file inclusion vulnerability in Extreme Networks HiveOS and IQ Engine that permits root-level remote code execution via log poisoning.

The GeoDirectory plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the design_type parameter, allowing remote attackers to execute arbitrary PHP code.

The WPCafe WordPress plugin contains a local file inclusion vulnerability in its template scope function, allowing authenticated contributors to execute arbitrary PHP files.

Authenticated attackers with contributor-level access can exploit a Local File Inclusion vulnerability in the SiteOrigin Widgets Bundle WordPress plugin to execute arbitrary PHP code via the REST API.

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to CSRF in the admin API, allowing unauthenticated attackers to perform state-changing operations via malicious web pages.

Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability in update_category.php allowing authenticated users to upload and execute arbitrary files via the update_image parameter.

An authenticated local file inclusion vulnerability in the WP Maps plugin allows subscribers to execute arbitrary PHP files on WordPress servers via the page parameter.

Visual Composer Website Builder for WordPress versions 45.16.0 and earlier are vulnerable to unauthenticated local file inclusion via the vcv-template parameter, allowing arbitrary file execution.

An unauthenticated-accessible Local File Inclusion vulnerability in the WP Travel Engine plugin (CVE-2026-9231) allows authenticated contributors to achieve remote code execution by including arbitrary PHP files.

The HUSKY Products Filter for WooCommerce Professional plugin (<= 1.4.4) is vulnerable to unauthenticated Local File Inclusion (LFI) due to inadequate nonce protection, allowing remote code execution via arbitrary PHP file inclusion.

A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint allows a remote attacker with a valid operator cookie to achieve remote code execution.

The GEO my WP plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the gmw_posts_locator_ajax_info_window_loader function, which can be escalated to remote code execution in specific PEAR-enabled environments.

MaxSite CMS versions up to 109.6 contain a local file inclusion vulnerability in its ajax and require-maxsite dispatchers allowing unauthenticated attackers to execute arbitrary privileged handlers.

The Eventin WordPress plugin contains a local file inclusion vulnerability in the event_layout parameter, allowing authenticated contributors to execute arbitrary PHP code.

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

An unauthenticated Local File Inclusion (LFI) vulnerability in the Divi Ajax Filter plugin for WordPress enables attackers to execute arbitrary PHP code via the custom_loop_template parameter.

An unauthenticated Local File Inclusion vulnerability in Verdure Core versions 1.2 and earlier allows remote attackers to execute arbitrary PHP code on affected WordPress sites.

An authenticated admin can achieve remote code execution in NocoBase prior to v2.1.5 by chaining arbitrary file uploads via storage root manipulation with a local file inclusion vulnerability in the plugin manager.

Ray 2.56.0 contains a directory traversal and local file inclusion vulnerability in the /api/v0/logs endpoint allowing unauthenticated attackers to read arbitrary files.

Leantime 3.6.2 contains a vulnerability in the Blueprints::import method allowing authenticated attackers to perform SSRF and LFI via the JSON-RPC API.

The Planyo Online Reservation System plugin for WordPress, in all versions up to and including 3.0, is vulnerable to Server-Side Request Forgery (SSRF) leading to Local File Inclusion (LFI), allowing an unauthenticated attacker to exploit the `ulap.php` file by supplying a `file://` URL that bypasses the host allowlist, reading arbitrary local files on the server and retrieving their contents in the HTTP response, potentially disclosing sensitive data.

A Local File Inclusion vulnerability exists in the LA-Studio Element Kit for Elementor plugin for WordPress, affecting all versions up to and including 1.6.1, which allows authenticated attackers with contributor-level access or higher to include and execute arbitrary .php files on the server due to improper path traversal handling and an easily bypassed extension check, leading to PHP code execution, access control bypass, and sensitive data exposure.

The `css_parser` library, specifically in versions up to and including 2.2.0, is vulnerable to Server-Side Request Forgery (SSRF) and local file disclosure through improper URI validation in the `CssParser::Parser#read_remote_file` method, allowing attackers to access internal network resources or read local files when processing attacker-controlled CSS.

An attacker can chain multiple vulnerabilities in motionEye, including an arbitrary file read (LFI), a signature bypass using password hashes, and an unsafe configuration restore, to achieve unauthenticated remote code execution (RCE) if the normal user password is unset, or authenticated RCE from a normal user account.

FreePBX released security advisories addressing authenticated SQL injection and local file inclusion vulnerabilities in the Security-Reporting cdr and dashboard modules for FreePBX 16 and 17.

The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion (LFI) in versions up to 4.1.0, allowing authenticated attackers with subscriber-level access to include and execute arbitrary PHP files on the server via the 'template' parameter, potentially leading to access control bypass, sensitive data access, or code execution.

A public exploit, rwsploit, has been released targeting CVE-2012-3152 and CVE-2012-3153 in Oracle Reports Server versions below 11g, enabling unauthenticated file read, SSRF, and JSP shell upload.

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to local file inclusion (LFI) via the 'path' parameter in the 'get_content' AJAX action, allowing authenticated attackers with Author-level access or higher to include and execute arbitrary PHP files, leading to potential code execution.

A local file inclusion vulnerability (CVE-2026-39850) exists in Yii 2 versions prior to 2.0.55 due to the `View::renderPhpFile()` method's handling of the `_file_` parameter, allowing attackers to read arbitrary files and potentially achieve remote code execution if they can write PHP files.

CVE-2025-5804 is a PHP Local File Inclusion vulnerability in the Case Theme User WordPress plugin before version 1.0.4 due to improper filename control in include/require statements, potentially allowing attackers to execute arbitrary code by including malicious local files.

CVE-2025-58913 is a PHP Local File Inclusion vulnerability in the CactusThemes VideoPro WordPress theme, affecting versions from n/a through 2.3.8.1 due to improper control of the filename for include/require statements, potentially allowing unauthorized file access.

Detection of potential Local File Inclusion (LFI) activity on web servers through HTTP GET requests attempting to access sensitive local files via directory traversal or known file paths, potentially leading to information disclosure and system compromise.

Froxlor is vulnerable to local file inclusion via path traversal in the `def_language` parameter of the API, leading to remote code execution as the web server user.

WWBN AVideo versions up to 26.0 are vulnerable to an arbitrary local file read via the `chunkFile` parameter in the `POST /objects/aVideoEncoder.json.php` endpoint, allowing authenticated users to read sensitive server files.

Detection of local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers through analysis of Kubernetes logs.

This rule detects potential Local File Inclusion (LFI) exploitation on web servers by identifying HTTP GET requests attempting to access sensitive local files through directory traversal or known file paths, potentially leading to sensitive information disclosure.

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint (CVE-2026-7807) that allows authenticated users to read arbitrary .json files, potentially leading to credential compromise.

The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion (LFI) due to insufficient sanitization of the template name parameter, allowing authenticated attackers to include and execute arbitrary files on the server.

AVideo is vulnerable to local file inclusion (LFI) via the EncoderReceiveImage endpoint, allowing authenticated uploaders to read sensitive server files by bypassing path traversal restrictions.