CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- corebos, tsolucio tsolucio/corebos +1 morePHP Remote File Inclusion in tsolucio/corebos9.8 Critical
- maggioli appalti \& contrattiAn issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local...7.5 High
- opensecurity mobile security frameworkMobSF allows attackers to read arbitrary files via a crafted HTTP request7.5 High
- simple college website project college websiteA remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to...9.8 Critical
- esri arcgis serverRemote file inclusion vulnerability in ArcGIS Server help documentation4.7 Medium
- concretecms concrete cmsImproper file handling in concrete5/core7.2 High
- advantech r-seenetA local file inclusion (LFI) vulnerability exists in the options.php script functionality of...8.1 High
- teradici cloud access connector, cloud access connector legacy +1 moreThe Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy...7.5 High
- octobercms octoberLocal File read vulnerability in OctoberCMS4.8 Medium
- larvit larvitbaseUnintended Require in larvitbase-api7.5 High
- honeywell experion pks, experion process knowledge system +1 moreA file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x...9.8 Critical
- schneider-electric bmxnoc0401 firmware, bmxnoe0100 firmware, bmxnoe0110 firmware +8 more +10 moreRemote file inclusion allows an attacker to craft a specific URL referencing the Schneider...5.4 Medium
- imagely nextgen gallery plugin, nextgen gallery +1 moreThe Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file7.5 High
- trend micro smart protection server (standalone), trendmicro smart protection server +1 moreA vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could...8.1 High