CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- magepeople inc. wptravelly WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability 8.8 High
- magepeople inc. wptravelly WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability 8.8 High
- picocodes noptin – newsletter, new post notifications & email automation Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name 5.9 Medium
- suitecrm SuiteCRM: LFI to RCE via AOW_WorkFlow 9.9 Critical
- control web panel web panel Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php 8.7 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 more WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability 6.5 Medium
- dedecms DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php 8.7 High
- bitpressadmin bit flows: ai agent automation & integrations for forms, crm, ecommerce, google sheets, and more Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters 5.9 Medium
- c97net cart engine, kemana directory, qengine cms +2 more C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php 7.1 High
- ancorathemes your dress WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability 8.1 High
- cozythemes rootblox WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 9.8 Critical
- broadstreet ad widget Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter 7.7 High
- elated-themes academist core WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability 8.1 High
- pedro marcelo issuu panel Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php 9.2 Critical
- armorx global technology spam ArmorX Global Technology｜ArmorX Spam - Local File Inclusion 7.1 High
- brandtoss wp mailster, wp mailster mailster +1 more WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability 6.5 Medium
- yourls YOURLS: Unauthenticated File Inclusion 5.3 Medium
- kitae-park mang board Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter 8.1 High
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms – wp lms for elearning, online courses, & quizzes +1 more LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes 7.5 High
- wpdesk shopmagic – email automation for wordpress ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter 8.1 High
- andrea tarantini bp profile search BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value 8.1 High
- elated-themes ambient WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability 8.1 High
- kutethemes kuteshop WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability 8.1 High
- kutethemes boutique WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability 8.1 High
- kutethemes biolife WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability 8.1 High
- kutethemes techone WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability 8.1 High
- kutethemes armania WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability 8.1 High
- mymoun backhoe WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability 8.1 High
- themerex ozeum WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability 8.1 High
- ckthemes flipmart WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability 8.1 High
- cocobasic fabius WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability 8.1 High
- cocobasic teoro WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability 8.1 High
- cocobasic kaven WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability 8.1 High
- cocobasic volos WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability 8.1 High
- cocobasic cardea WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability 8.1 High
- designinvento directorypress WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability 9.8 Critical
- mikado-themes touchup WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability 8.1 High
- kutethemes dukamarket WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability 8.1 High
- kutethemes uminex WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability 8.1 High
- edge-themes aalto WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability 8.1 High
- ancorathemes cleanskin WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability 8.1 High
- axiomthemes kids care WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability 8.1 High
- paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter 8.1 High
- fuelthemes the voux WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability 8.1 High
- fuelthemes werkstatt WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability 8.1 High
- arraytics wpcafe – restaurant menu, online food ordering & table booking system WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting 7.5 High
- gpriday siteorigin widgets bundle SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter 7.5 High
- getsimplecms-ce GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field 7.1 High
- brainstorm force cartflows WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability 8.8 High
- croixhaug simply schedule appointments Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter 7.5 High
- Show olderLoading…