Information Disclosure
Monthly
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
Sensitive information exposure in WPXPO PostX plugin for WordPress (version 5.0.3 and below) allows remote unauthenticated attackers to retrieve embedded sensitive data via network-based requests. The vulnerability carries a CVSS 5.3 (Medium) score, with low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code. It involves improper exposure of system information to an unauthorized control sphere.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.
Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid security credentials to be accepted, permitting unauthorized participants to join a secured DDS domain and exchange data over connections that should have been refused. The flaw sits in the DDS Security access-control layer (Permissions handling) and undermines the confidentiality and integrity guarantees of an otherwise authenticated domain. Rated CVSS 10.0 with a scope change, but EPSS is low (0.30%, 22th percentile) and there is no public exploit identified at time of analysis, so real-world risk is narrower than the base score implies.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Local privilege escalation in NetBT Consulting Services e-Fatura versions prior to 1.2.15 allows authenticated low-privileged users to leverage an unquoted Windows service path to execute arbitrary code with elevated privileges. Publicly available exploit code exists (Exploit-DB 52509), though EPSS scoring (0.20%, 42nd percentile) suggests limited widespread exploitation, and the issue is not currently listed in CISA KEV.
CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote attackers with high complexity to conduct information disclosure attacks against the reCAPTCHA mechanism. The vulnerability stems from improper handling of K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY parameters in couch/config.example.php, and publicly available exploit code exists, though real-world exploitation probability remains low (EPSS 0.06%).
HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.
Improper initialization in the PFCP handler function ogs_pfcp_handle_create_pdr within Open5GS up to version 2.7.5 allows remote attackers to trigger information disclosure with high attack complexity. The vulnerability has a publicly available proof-of-concept and carries a very low EPSS score (0.15%), indicating minimal real-world exploitation probability despite public availability of exploit code. CVSS 2.9 reflects the limited technical impact (availability of confidentiality only), but the high complexity and resource requirements make practical attacks difficult.
The Online Food Delivery System by Restajet Information Technologies through version 19122025 fails to restrict repeated authentication attempts, enabling password recovery exploitation and unauthorized account access. With a CVSS score of 9.1 (critical severity) and unauthenticated network-based attack vector, attackers can brute-force credentials without lockout mechanisms. No public exploit is identified at time of analysis, with EPSS probability at 0.07% (22nd percentile). The vendor did not respond to early disclosure attempts by Turkey's national CERT (USOM).
Session token disclosure in M-Files Server (all releases before 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5) lets an authenticated attacker using the M-Files Web client capture the live session tokens of other users who are concurrently active in the web interface. The captured tokens can then be replayed to impersonate those victims, giving high confidentiality and integrity impact across account boundaries, as reflected in our assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Exploitation requires a valid low-privileged M-Files Web account plus the presence of other active sessions, which meaningfully constrains real-world risk; there is no public exploit code identified at time of analysis and no CISA KEV listing, and EPSS is low at 0.48% (39th percentile), so this is an above-average-priority issue rather than an emergency.
JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.
Improper authorization in Campcodes Advanced Voting Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/voters_edit.php, resulting in unauthorized modification of voter passwords. The vulnerability affects the Password Handler component and requires valid user credentials to exploit, limiting real-world risk despite public exploit availability. EPSS exploitation probability is low at 0.06 percentile, suggesting this flaw targets specific administrative scenarios rather than representing widespread attack potential.
Remote denial-of-service in the omec-project UPF (pfcpiface component, version upf-epc-pfcpiface 2.1.3-dev) lets any endpoint able to reach the N4/PFCP interface crash the user-plane function by sending a malformed PFCP Session Establishment Request. The request carries a CreateFAR IE with an empty or truncated IPv4 address; parseFAR() passes it to ip2int(), which reads past the buffer and triggers a Go index-out-of-range panic (CWE-125). Publicly available exploit references exist via the upstream issue tracker, though EPSS remains low (0.46%) and it is not on CISA KEV.
WP AI CoPilot plugin for WordPress versions through 1.2.7 exposes sensitive information embedded within sent data, allowing attackers to retrieve confidential details without proper access controls. The vulnerability stems from inadequate handling of sensitive data in communications, classified as information disclosure with an EPSS score of 0.04% indicating low real-world exploitation probability. No public exploit code has been identified at time of analysis.
Remote code execution in Mozilla Firefox via use-after-free in Disability Access APIs allows unauthenticated network attackers to compromise browser integrity with high impact. The vulnerability (CWE-416) affects Firefox versions prior to 146.0.1 and requires no user interaction or special privileges. With CVSS 9.8 (Critical) but low EPSS (0.07%, 21st percentile), real-world exploitation probability remains limited despite theoretical severity. No public exploit identified at time of analysis, and vendor-released patch 146.0.1 available.
Unicode right-to-left override (RTLO) characters in malicious websites can spoof filenames displayed in Firefox for iOS downloads UI, potentially tricking users into saving files with misleading extensions and types. Affects Firefox for iOS versions prior to 144.0; requires user interaction to download a file. The vulnerability has low real-world exploitation probability (EPSS 0.04%) despite the moderate CVSS score, as it relies on social engineering and user inattention rather than automatic code execution.
Stored HTML injection in Nozomi Networks CMC and Guardian Asset List functionality allows unauthenticated remote attackers to inject malicious HTML tags into asset attributes via crafted network packets, enabling phishing and open redirect attacks when victims view affected assets. CVSS 5.3 (medium severity) with user interaction required; exploitation is bounded by existing Content Security Policy and input validation that prevent full XSS and direct information disclosure.
Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.
Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.
Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.
Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.
Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).
Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.
Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.
Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.
Local file inclusion in the Rare Radio WordPress theme (AncoraThemes, versions through 1.0.15.1) exposes WordPress installations to arbitrary PHP file inclusion via unsanitized user input passed to PHP include/require statements. An unauthenticated remote attacker with sufficient complexity can traverse the server filesystem to include PHP files already resident on the server, potentially achieving code execution, credential theft, and full site compromise. No public exploit code or active exploitation has been identified; EPSS is very low at 0.08% (23rd percentile), reflecting limited real-world threat at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch
Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.
Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
Sensitive information exposure in WPXPO PostX plugin for WordPress (version 5.0.3 and below) allows remote unauthenticated attackers to retrieve embedded sensitive data via network-based requests. The vulnerability carries a CVSS 5.3 (Medium) score, with low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code. It involves improper exposure of system information to an unauthorized control sphere.
Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.
Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.
Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid security credentials to be accepted, permitting unauthorized participants to join a secured DDS domain and exchange data over connections that should have been refused. The flaw sits in the DDS Security access-control layer (Permissions handling) and undermines the confidentiality and integrity guarantees of an otherwise authenticated domain. Rated CVSS 10.0 with a scope change, but EPSS is low (0.30%, 22th percentile) and there is no public exploit identified at time of analysis, so real-world risk is narrower than the base score implies.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
Denial-of-service potential in the Linux kernel's spinlock debugging instrumentation (do_raw_write_lock) stems from an unmarked read/write in debug_write_lock_before(), producing a data-race flagged by the Kernel Concurrency Sanitizer (KCSAN). Only kernels built with lock debugging enabled are affected, and the fix completes prior race-hardening work (commit 1a365e822372) by converting the remaining access to WRITE_ONCE(). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Local privilege escalation in NetBT Consulting Services e-Fatura versions prior to 1.2.15 allows authenticated low-privileged users to leverage an unquoted Windows service path to execute arbitrary code with elevated privileges. Publicly available exploit code exists (Exploit-DB 52509), though EPSS scoring (0.20%, 42nd percentile) suggests limited widespread exploitation, and the issue is not currently listed in CISA KEV.
CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote attackers with high complexity to conduct information disclosure attacks against the reCAPTCHA mechanism. The vulnerability stems from improper handling of K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY parameters in couch/config.example.php, and publicly available exploit code exists, though real-world exploitation probability remains low (EPSS 0.06%).
HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.
Improper initialization in the PFCP handler function ogs_pfcp_handle_create_pdr within Open5GS up to version 2.7.5 allows remote attackers to trigger information disclosure with high attack complexity. The vulnerability has a publicly available proof-of-concept and carries a very low EPSS score (0.15%), indicating minimal real-world exploitation probability despite public availability of exploit code. CVSS 2.9 reflects the limited technical impact (availability of confidentiality only), but the high complexity and resource requirements make practical attacks difficult.
The Online Food Delivery System by Restajet Information Technologies through version 19122025 fails to restrict repeated authentication attempts, enabling password recovery exploitation and unauthorized account access. With a CVSS score of 9.1 (critical severity) and unauthenticated network-based attack vector, attackers can brute-force credentials without lockout mechanisms. No public exploit is identified at time of analysis, with EPSS probability at 0.07% (22nd percentile). The vendor did not respond to early disclosure attempts by Turkey's national CERT (USOM).
Session token disclosure in M-Files Server (all releases before 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5) lets an authenticated attacker using the M-Files Web client capture the live session tokens of other users who are concurrently active in the web interface. The captured tokens can then be replayed to impersonate those victims, giving high confidentiality and integrity impact across account boundaries, as reflected in our assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Exploitation requires a valid low-privileged M-Files Web account plus the presence of other active sessions, which meaningfully constrains real-world risk; there is no public exploit code identified at time of analysis and no CISA KEV listing, and EPSS is low at 0.48% (39th percentile), so this is an above-average-priority issue rather than an emergency.
JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.
Improper authorization in Campcodes Advanced Voting Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/voters_edit.php, resulting in unauthorized modification of voter passwords. The vulnerability affects the Password Handler component and requires valid user credentials to exploit, limiting real-world risk despite public exploit availability. EPSS exploitation probability is low at 0.06 percentile, suggesting this flaw targets specific administrative scenarios rather than representing widespread attack potential.
Remote denial-of-service in the omec-project UPF (pfcpiface component, version upf-epc-pfcpiface 2.1.3-dev) lets any endpoint able to reach the N4/PFCP interface crash the user-plane function by sending a malformed PFCP Session Establishment Request. The request carries a CreateFAR IE with an empty or truncated IPv4 address; parseFAR() passes it to ip2int(), which reads past the buffer and triggers a Go index-out-of-range panic (CWE-125). Publicly available exploit references exist via the upstream issue tracker, though EPSS remains low (0.46%) and it is not on CISA KEV.
WP AI CoPilot plugin for WordPress versions through 1.2.7 exposes sensitive information embedded within sent data, allowing attackers to retrieve confidential details without proper access controls. The vulnerability stems from inadequate handling of sensitive data in communications, classified as information disclosure with an EPSS score of 0.04% indicating low real-world exploitation probability. No public exploit code has been identified at time of analysis.
Remote code execution in Mozilla Firefox via use-after-free in Disability Access APIs allows unauthenticated network attackers to compromise browser integrity with high impact. The vulnerability (CWE-416) affects Firefox versions prior to 146.0.1 and requires no user interaction or special privileges. With CVSS 9.8 (Critical) but low EPSS (0.07%, 21st percentile), real-world exploitation probability remains limited despite theoretical severity. No public exploit identified at time of analysis, and vendor-released patch 146.0.1 available.
Unicode right-to-left override (RTLO) characters in malicious websites can spoof filenames displayed in Firefox for iOS downloads UI, potentially tricking users into saving files with misleading extensions and types. Affects Firefox for iOS versions prior to 144.0; requires user interaction to download a file. The vulnerability has low real-world exploitation probability (EPSS 0.04%) despite the moderate CVSS score, as it relies on social engineering and user inattention rather than automatic code execution.
Stored HTML injection in Nozomi Networks CMC and Guardian Asset List functionality allows unauthenticated remote attackers to inject malicious HTML tags into asset attributes via crafted network packets, enabling phishing and open redirect attacks when victims view affected assets. CVSS 5.3 (medium severity) with user interaction required; exploitation is bounded by existing Content Security Policy and input validation that prevent full XSS and direct information disclosure.
Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.
Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.
Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.
Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.
Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).
Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.
Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.
Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.
Local file inclusion in the Rare Radio WordPress theme (AncoraThemes, versions through 1.0.15.1) exposes WordPress installations to arbitrary PHP file inclusion via unsanitized user input passed to PHP include/require statements. An unauthenticated remote attacker with sufficient complexity can traverse the server filesystem to include PHP files already resident on the server, potentially achieving code execution, credential theft, and full site compromise. No public exploit code or active exploitation has been identified; EPSS is very low at 0.08% (23rd percentile), reflecting limited real-world threat at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch
Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.
Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.