CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- rameez iqbal real estate managerWordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability7.5 High
- joomsky js job managerWordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability8.8 High
- stylemix motorsWordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability8.8 High
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability8.8 High
- zankover fami woocommerce compareWordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerability7.5 High
- debounce email validatorWordPress DeBounce Email Validator plugin <= 5.7 - Local File Inclusion Vulnerability7.5 High
- hossein material dashboardWordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability8.1 High
- infornweb news & blog designer packWordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerability8.1 High
- joomsky js help deskWordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerability8.1 High
- wp travel engine travel engine, wptravelengine wp travel engine +1 moreWordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability8.1 High
- g5plus essential real estateWordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability8.1 High
- wp shuffle subscribe to download liteWordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerability7.5 High
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability7.5 High
- crocoblock jetwoobuilderWordPress JetWooBuilder plugin <= 2.1.18 - Local File Inclusion vulnerability7.5 High
- bastien ho accounting for woocommerceWordPress Accounting for WooCommerce plugin <= 1.6.8 - Local File Inclusion vulnerability7.5 High
- chop chop pop-up chop chopWordPress Pop-Up Chop Chop plugin <= 2.1.7 - Local File Inclusion Vulnerability7.5 High
- realmag777 huskyWordPress HUSKY plugin <= 1.3.6.4 - Local File Inclusion vulnerability7.5 High
- john darrel hide my wp ghostWordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability9.6 Critical
- magepeopleteam wptravellyWordPress WpTravelly Plugin <= 1.8.7 - Local File Inclusion vulnerability8.8 High
- suiteplugins login widget for ultimate memberWordPress Login Widget for Ultimate Member plugin <= 1.1.2 - Local File Inclusion vulnerability7.5 High
- wp travel engine travel engine, wptravelengine wp travel engine +1 moreWordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability7.5 High
- maidul team managerWordPress Team Manager plugin <= 2.1.23 - Local File Inclusion Vulnerability7.5 High
- jetmonsters restaurant menu by motopressWordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerability8.8 High
- webangon the pack elementor addonsWordPress The Pack Elementor addons plugin <= 2.1.1 - Local File Inclusion vulnerability7.5 High
- themifyme themify event postWordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerability7.5 High
- arraytics wpcafeWordPress WPCafe plugin <= 2.2.31 - Local File Inclusion vulnerability7.5 High
- ht plugins wishsuiteWordPress WishSuite plugin <= 1.4.4 - Local File Inclusion Vulnerability7.5 High
- radiustheme the post gridWordPress The Post Grid plugin <= 7.7.17 - Local File Inclusion vulnerability7.5 High
- wp shuffle subscribe to download liteWordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion Vulnerability7.5 High
- stylemixthemes pearl - corporate businessWordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability8.1 High
- designingmedia hostikoWordPress Hostiko Theme < 30.1 - Local File Inclusion vulnerability7.5 High
- notfound docproWordPress Docpro plugin <= 2.0.1 - Local File Inclusion vulnerability9.8 Critical
- michele giorgi formalityWordPress Formality Plugin <= 1.5.7 - Local File Inclusion vulnerability8.1 High
- ntm custom-field-list-widgetWordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerability8.1 High
- alex furr linkedin liteWordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability8.1 High
- thememove minimogwp – the high converting ecommerce wordpress themeMinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion9.8 Critical
- wp sharks s2member pros2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode8.8 High
- systemic-rm risk valueSystemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=....7.5 High
- shinecommerce traveler, shinetheme travel booking wordpress theme +1 moreTraveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post9.8 Critical
- techlabpro1 review schema – review & structure data schema pluginReview Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta8.8 High
- zucchetti ad hoc infinityA local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows...7.3 High
- nitin prakash wc place order without paymentWordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability7.5 High
- epc massive dynamicWordPress Massive Dynamic theme <= 8.2 - Unauthenticated Local File Inclusion vulnerability9.0 Critical
- creativeitem doctor appointment bookingWordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- joomsky wp vehicle managerWordPress Vehicle Manager plugin <= 3.1 - Local File Inclusion vulnerability8.1 High
- notfound popliupWordPress Popliup Plugin <= 1.1.1 - Local File Inclusion vulnerability7.5 High
- oneadvanced tikit emarketingDirectory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing...5.1 Medium
- creativeon whmpress - whmcs wordpress integration plugin, whmpress whmcs +1 moreWHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update9.8 Critical
- shinetheme travel booking wordpress themeTraveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- aman funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.9.0 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…