https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:52:34 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63302 <p>Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application&#39;s directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server&#39;s directory structure and absolute file paths (path disclosure).</p> <p>The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.</p> <p>Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application&#39;s directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server&#39;s directory structure and absolute file paths (path disclosure).</p> <p>The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63302 https://vulnerability.circl.lu/vuln/ghsa-87pr-j64q-3qv5 <p>Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application&#39;s directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server&#39;s directory structure and absolute file paths (path disclosure).</p> <p>The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.</p> <p>Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application&#39;s directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server&#39;s directory structure and absolute file paths (path disclosure).</p> <p>The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.</p> https://vulnerability.circl.lu/vuln/ghsa-87pr-j64q-3qv5