CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- easydigitaldownloads easy digital downloads, wow-company easy digital downloads – recent purchases +1 moreWordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability9.6 Critical
- mayurik gas agency management systemSourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via...8.1 High
- nicdark elements for elementorElements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes8.8 High
- vanderwijk content blocks (custom post widget), content blocks +1 moreContent Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- thenahidul responsive owl carousel for elementorResponsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion8.8 High
- themenectar salient coreSalient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode7.5 High
- themenectar salient shortcodes, salient core +1 moreSalient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- everpress mailsterWordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability8.1 High
- premmerce permalink manager for woocommerceWordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability8.3 High
- pencidesign penci soledad data migratorPenci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion9.8 Critical
- plugins360 all-in-one video galleryAll-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode8.8 High
- linqiAn issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file...9.8 Critical
- cacti, fedoraproject fedora +1 moreCacti RCE vulnerability by file include in lib/plugin.php8.1 High
- p-themes porto theme - functionality, portotheme functionality +1 morePorto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta8.8 High
- p-themes porto theme - functionalityPorto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- p-themes portoPorto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts9.8 Critical
- ravanh xml sitemap & google newsXML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion8.1 High
- p-themes portoPorto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta8.8 High
- cmseasyCmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the...4.9 Medium
- holithemes click to chat – holithemesClick to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion8.8 High
- wpmet elementskit, elementskit pro +1 moreElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets8.8 High
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementor, wpmet elements kit elementor addons +1 moreElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module8.8 High
- parisneo lollms-webui, parisneo/lollms-webui, lollms web ui +2 moreLocal File Inclusion in parisneo/lollms-webui9.3 Critical
- stylemixthemes masterstudy lms, stylemix masterstudy lms wordpress plugin – for online courses and education +1 moreMasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template9.8 Critical
- donbermoy complete e-commerce site, sourcecodester complete ecommerce site +1 moreArbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows...9.8 Critical
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementor, wpmet elements kit elementor addons +1 moreElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw8.8 High
- realmag777 husky – products filter professional for woocommerce, pluginus husky - products filter professional for woocommerce +1 moreHUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion7.2 High
- stylemixthemes masterstudy lms, stylemix masterstudy lms wordpress plugin – for online courses and education +1 moreMasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal9.8 Critical
- nicdark restaurant reservationsRestaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion8.8 High
- getshieldsecurity shield security, paultgoodchild shield: blocks bots, protects users, and prevents security breaches +1 moreShield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion9.8 Critical
- trend micro, inc. micro apex central, trendmicro apex central +1 moreA local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a...7.5 High
- fireeye central managementRemote file inclusion vulnerability in FireEye Central Management6.6 Medium
- carazo import and export users and customersImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality6.6 Medium
- cactiLocal File Inclusion (RCE) in Cacti8.1 High
- infornweb blog designer pack – blog, post grid, post slider, post carousel, category post, news, news \& blog designer pack, news \& blog designer pack wordpress blog plugin +2 moreNews & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion8.1 High
- jonashjalmarsson html filter and csv-file searchHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- g5theme grid plus, grid plus – unlimited grid layout +1 moreGrid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode8.8 High
- bloafer php to page, php to page project to page +1 morePHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode9.9 Critical
- hyno dropbox folder shareDropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion9.8 Critical
- frangoteam fuxaFUXA local file inclusion vulnerability7.5 High
- frangoteam fuxaFUXA vulnerable to Local File Inclusion7.5 High
- yiiframework yiiYii2 allows attackers to execute any local .php file via a relative path in the view parameter9.8 Critical
- geomatika isigeo webAn issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to...4.9 Medium
- flarum, flarum framework +1 moreServer-Side Request Forgery via Avatar upload in flarum7.1 High
- cantoCanto <= 3.0.4 - Unauthenticated Remote File Inclusion9.8 Critical
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 morePHP Remote File Inclusion in cockpit-hq/cockpit9.9 Critical
- gvectors wpforo forumwpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents8.8 High
- bumsys project bumsys, unilogies unilogies/bumsys +1 morePHP Remote File Inclusion in unilogies/bumsys7.2 High
- agilebio electronic lab notebookAgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion...8.8 High
- flatpress, flatpressblog flatpressblog/flatpress +1 morePHP Remote File Inclusion in flatpressblog/flatpress8.8 High
- Show moreLoading…