CVE-2025-12549
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Jan 8, 2026
CISA due date
—
The record
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and… CWE-98
- CVE-2026-15406 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
- CVE-2026-15667 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin… CWE-98
- CVE-2026-11613 The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98
- CVE-2026-28150 Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. CWE-98
- CVE-2026-66586 Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. CWE-98
- CVE-2026-75963 The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all… CWE-98
- CVE-2026-73387 Unauthenticated Local File Inclusion in Resido <= 1.5 versions. CWE-98