CVE-2010-20125
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-98
Not enough EPSS history yet.
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- github.comhttps://github.com/dedecms/DedeCMS/blob/v5.6/plus/carbuyaction.php
- github.comhttps://github.com/dedecms/DedeCMS/releases/tag/v5.7
- github.comhttps://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-carbuyaction-fileinclude.yaml
- web.archive.orghttps://web.archive.org/web/20100630011301/https://www.myhack58.com/Article/html/3/62/2010/27387.htm
- www.cnblogs.comhttps://www.cnblogs.com/milantgh/p/3615986.html
- www.vulncheck.comhttps://www.vulncheck.com/advisories/dedecms-file-inclusion-via-plus-carbuyaction-php
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1101855.9 MED46.0%
——14The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case.2dCVE-2014-1251376.5 MED53.8%
——16C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.2dCVE-2026-1128508.1 HIG27.0%
——8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.6dCVE-2026-1128329.8 CRI38.2%
——11Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.8dCVE-2026-1128208.1 HIG38.0%
——11Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.8dCVE-2017-202897.5 HIG60.5%
——18Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.7d