CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- arraytics eventinWordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability7.5 High
- deetronix affiliate couponsWordPress Affiliate Coupons plugin <= 1.7.3 - Local File Inclusion vulnerability7.5 High
- quantumcloud chatbotWordPress WPBot plugin <= 6.3.5 - Local File Inclusion vulnerability7.5 High
- majestic support supportWordPress Majestic Support plugin <= 1.0.6 - Local File Inclusion vulnerability8.1 High
- vinagecko vg postcarouselWordPress VG PostCarousel plugin <= 1.1 - Local File Inclusion vulnerability7.5 High
- wow-company calculator builderWordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerability7.5 High
- full services customerWordPress FULL – Cliente plugin <= 3.1.26 - Local File Inclusion vulnerability7.5 High
- cyberchimps responsive addons for elementor, responsive addons for elementor – free elementor addons, kits and elementor templates +1 moreResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion8.8 High
- labibahmed42 team builder for wpbakery page builder(formerly visual composer), webdevocean team-builder-for-wpbakery-page-builder +1 moreTeam Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusion7.5 High
- oscar alvarez cookie monsterWordPress Cookie Monster Plugin <= 1.2.2 - Local File Inclusion vulnerability8.1 High
- zankover fami sales popupWordPress Fami Sales Popup plugin <= 2.0.0 - Local File Inclusion vulnerability7.5 High
- px-lab boombox theme extensionsBoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- artbees jupiter x coreJupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)8.8 High
- abb flxeonRemote Code Execution (RCE) Vulnerabilities10.0 Critical
- wpwax post grid, slider & carousel ultimate, post grid\, slider \& carousel ultimate +1 moreWordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability6.5 Medium
- themerex addonsThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- addonmaster post grid masterWordPress Post Grid Master plugin <= 3.4.12 - Local File Inclusion vulnerability6.5 Medium
- ibm maximo asset managementIBM Maximo Asset Management file upload6.5 Medium
- pickplugins post grid, wpwax post grid, slider & carousel ultimate – with shortcode, gutenberg block & elementor widget +1 morePost Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion7.5 High
- bmltenabled meeting map, otrok7 bmlt meeting map +1 moreBMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion7.5 High
- dzeriho improved sale badges – free versionWordPress Improved Sale Badges – Free Version Plugin <= 1.0.1 - Local File Inclusion vulnerability8.1 High
- webarea background animation blocksWordPress Background animation blocks Plugin <= 2.1.5 - Local File Inclusion vulnerability8.1 High
- crudlab image gallery box by crudlabWordPress Image Gallery Box by CRUDLab Plugin <= 1.0.3 - Local File Inclusion vulnerability7.5 High
- deluxethemes private messages for userproWordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability7.5 High
- roninwp fat event liteWordPress FAT Event Lite plugin <= 1.1 - Authenticated Non-Arbitrary Local File Inclusion vulnerability7.5 High
- roninwp fat event liteWordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability8.1 High
- carbonphp carbonCarbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale6.3 Medium
- rezgo, rezgo online booking +1 moreWordPress Rezgo Online Booking plugin <= 4.17 - Local File Inclusion vulnerability8.1 High
- buildapp build app onlineWordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability9.8 Critical
- codemstory 워드프레스 결제 심플페이WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin <= 5.2.0 - Local File Inclusion vulnerability7.5 High
- elicus wpmozo addons lite for elementorWordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerability7.5 High
- essential plugin hero banner ultimateWordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability6.5 Medium
- service shogun ach invoice appWordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerability7.5 High
- themify builder, themifyme themify builder +1 moreWordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability6.5 Medium
- dynamic web lab product category grid, slider for woocommerce, maidul dynamic product category grid, slider for woocommerce +1 moreWordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability7.5 High
- wptravelengine wp travel engine – elementor widgets | create travel booking website using wordpress and elementorWP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion8.8 High
- moaluko store locator for wordpress with google maps – lotsoflocalesStore Locator <= 3.98.10 - Unauthenticated Local File Inclusion9.8 Critical
- axeptioWordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability8.1 High
- spider themes eazydocsWordPress EazyDocs plugin <= 2.8.0 - Local File Inclusion vulnerability7.5 High
- wpwax product carousel slider & grid ultimate for woocommerceProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'8.8 High
- wpmart team memberWordPress Team Member – Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion vulnerability4.3 Medium
- codegearthemes designerWordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability7.5 High
- wphealth wp umbrella: update backup restore & monitoring, wp umbrella update backup restore and monitoring +1 moreWP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion9.8 Critical
- all bootstrap blocks bootstrap blocks, areoi all bootstrap blocks +1 moreWordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability7.5 High
- pencidesign soledadSoledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion8.1 High
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreLocal File Inclusion8.8 High
- premio testimonials, stars testimonials — responsive reviews & star ratings +1 moreFree Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion8.8 High
- cool plugins cryptocurrency widgets for elementorWordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability8.1 High
- abosoluteplugins absolute addons for elementorWordPress Absolute Addons For Elementor plugin <= 1.0.14 - Local File Inclusion vulnerability7.5 High
- quomodosoft shopreadyWordPress Shopready plugin <= 3.6 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…