CVE-2025-32614
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON allows PHP Local File Inclusion. This issue affects EventON: from n/a through 2.3.2.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 1.85%
- CWE
- CWE-98, CWE-98
- Published
- 2025-04-11
- Last modified
- 2026-05-12
Affected products
- Ashan Perera EventON
- Ashan Perera EventON
Weakness type
Related vulnerabilities
- CVE-2026-87927 — MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
- CVE-2026-15667 — Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-15406 — Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
- CVE-2026-11613 — Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
- CVE-2026-78566 — The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and...
- CVE-2026-78562 — The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,...
- CVE-2026-78478 — Måne <= 1.7 - Unauthenticated Local File Inclusion
- CVE-2026-14280 — Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys