Local File Inclusion in NotFound Hockeydata LOS by NotFound
CVE-2025-26889

7.5HIGH

Key Information:

Vendor

Notfound

Status
Hockeydata Los
Vendor
CVE Published:
15 April 2025

What is CVE-2025-26889?

An improper control of filename vulnerability exists within the NotFound Hockeydata LOS, allowing for PHP Local File Inclusion. This vulnerability enables attackers to potentially execute malicious code on the server by including arbitrary files, which can lead to unauthorized data access and compromise the integrity of the web application. Affected versions include all versions up to 1.2.4.

Affected Version(s)

hockeydata LOS <= 1.2.4

References

https://patchstack.com/database/wordpress/plugin/hockeyda...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dimas Maulana (Patchstack Alliance)
JSON
.