CVE-2014-125137
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability
CVSS
6.5
Medio
EPSS
0.7%
p54
KEV
—
Exploit Today
16
0-100
Publicado: 28 oct 2026 · Última mod.: 28 oct 2026 · CWE-98
0.7%EPSS · 30 días0.7%
2026-10-282026-10-29
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
- www.exploit-db.comhttps://www.exploit-db.com/exploits/32504
- www.exploit-db.comhttps://www.exploit-db.com/exploits/32508
- www.exploit-db.comhttps://www.exploit-db.com/exploits/32511
- www.exploit-db.comhttps://www.exploit-db.com/exploits/39129
- www.vulncheck.comhttps://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-local-file-inclusion-via-admin-task-php
- www.zeroscience.mkhttps://www.zeroscience.mk/advisories/ZSL-2014-5173.html
- www.zeroscience.mkhttps://www.zeroscience.mk/advisories/ZSL-2014-5177.html
- www.zeroscience.mkhttps://www.zeroscience.mk/advisories/ZSL-2014-5181.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-621216.5 MED—
———Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.5hCVE-2010-201257.5 ALT—
———DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.5hCVE-2026-1101855.9 MED46.0%
——14The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case.2dCVE-2026-1128508.1 ALT27.0%
——8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.6dCVE-2026-1128329.8 CRÍ38.2%
——11Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.8dCVE-2026-1128208.1 ALT38.0%
——11Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.8d