PULSEUnderground Intel

EN VIVO30señales / 24h

FEED

ransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerceransomakira reclama a Medienwerkstatt · DE · Educationransomakira reclama a Annapath · Not Foundransomrhysida reclama a DR.SCHNELL GmbH & Co. KGaA · DE · Manufacturingransomqilin reclama a Airtificial · Technologyransomqilin reclama a Bathurst RSL · AU · Hospitalityransomqilin reclama a Creative Universe · AU · Otherransomeverest reclama a PWC · GB · Professional Servicesransomn0n reclama a Performance Ford Inc · US · Retail & E-Commerceransomn0n reclama a Company #109 · Not Foundransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerceransomakira reclama a Medienwerkstatt · DE · Educationransomakira reclama a Annapath · Not Foundransomrhysida reclama a DR.SCHNELL GmbH & Co. KGaA · DE · Manufacturingransomqilin reclama a Airtificial · Technologyransomqilin reclama a Bathurst RSL · AU · Hospitalityransomqilin reclama a Creative Universe · AU · Otherransomeverest reclama a PWC · GB · Professional Servicesransomn0n reclama a Performance Ford Inc · US · Retail & E-Commerceransomn0n reclama a Company #109 · Not Found

← Todos los CVEs

CVE Watch22 oct 2026

CVE-2026-112820

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Acade

CVSS

8.1

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 22 oct 2026 · Última mod.: 22 oct 2026 · CWE-98

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/academist-core/vulnerability/wordpress-academist-core-plugin-1-4-1-local-file-inclusion-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1128329.8 CRÍ

———Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.7h CVE-2017-202897.5 ALT

———Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.11h CVE-2016-201018.1 ALT

——10Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.2d CVE-2026-1134026.5 MED

——9ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.2d CVE-2026-1118296.5 MED

——7Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.3d CVE-2026-628585.3 MED

——12YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.6d