CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- axiomthemes rhodosWordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerability8.1 High
- axiomthemes photoliaWordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability8.1 High
- axiomthemes a-martWordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability8.1 High
- automattic jetpack crmWordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability7.5 High
- mikado-themes fivestarWordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- edge-themes belletristWordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability8.1 High
- axiomthemes pj | life & business coachingWordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability8.1 High
- mikado-themes healthfirstWordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability8.1 High
- select-themes strukturWordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability8.1 High
- themerex freightcoWordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability8.1 High
- themerex r&fWordPress R&F theme <= 1.5 - Local File Inclusion vulnerability8.1 High
- themerex yokooWordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability8.1 High
- themerex cobbleWordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- themerex plankWordPress Plank theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- themerex tintWordPress Tint theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- themerex splendourWordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability8.1 High
- themerex gableWordPress Gable theme <= 1.5 - Local File Inclusion vulnerability8.1 High
- whatwouldjessedo simple retail menusWordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerability7.5 High
- agence web eoxia - montpellier wp shopWordPress WP shop plugin <= 2.6.1 - Local File Inclusion vulnerability7.5 High
- solverwp portfolio builderWordPress Portfolio Builder plugin <= 1.2.5 - Local File Inclusion vulnerability8.1 High
- solverwp eleblog – elementor blog and magazine addonsWordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability8.1 High
- beeteam368 vidorevWordPress VidoRev theme <= 2.9.9.9.9.9.7 - Local File Inclusion vulnerability7.5 High
- fuelthemes peakshopsWordPress PeakShops theme < 1.5.9 - Local File Inclusion vulnerability8.1 High
- themepul topperpack – complete elementor addons, theme & cpt builderWordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability7.5 High
- webcodingplace woocommerce coming soon product with countdownWordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerability7.5 High
- thembay nikaWordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability8.1 High
- thembay dizaWordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability8.1 High
- thembay fanaWordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability8.1 High
- thembay zotaWordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability8.1 High
- loftocean patiotimeWordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability8.1 High
- loftocean cozystayWordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability8.1 High
- thembay urnaWordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability8.1 High
- thembay besaWordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability8.1 High
- thembay haraWordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability8.1 High
- nenad obradovic extensive vc addons for wpbakery page builderWordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability8.1 High
- vankarwai airtifactWordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability7.5 High
- villatheme sales countdown timer for woocommerce and wordpressWordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability7.5 High
- cmsmasters content composerWordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability7.5 High
- prodigy commerce commerce, prodigycommerce prodigy commerce +1 moreProdigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]9.8 Critical
- invoiceplaneInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning9.1 Critical
- wpdecent flexi product slider and grid for woocommerceFlexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute7.5 High
- themeboy sportspress – sports club & league managerSportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- thememove unicampWordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability7.5 High
- talemy spirit frameworkWordPress Spirit Framework plugin <= 1.2.13 - Local File Inclusion vulnerability7.5 High
- gila cms cmsGila CMS < 2.0.0 - Remote Code Execution9.3 Critical
- shazdeh administrative shortcodesAdministrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute7.5 High
- devsblink edublink coreWordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerability7.5 High
- elated-themes laurentWordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability7.5 High
- elated-themes laurent coreWordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerability7.5 High
- omnipressteam omnipressWordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…