CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- themerex maxinetWordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability8.1 High
- themerex nexioWordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability8.1 High
- themerex plantyWordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability8.1 High
- themerex raider spiritWordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability8.1 High
- themerex rosaleenWordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability8.1 High
- themerex moderneeWordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability8.1 High
- themerex group learnifyWordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability8.1 High
- themerex group geyaWordPress Geya theme <= 1.15 - Local File Inclusion vulnerability8.1 High
- discuz! x5.0Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory8.6 High
- abtestWordPress Plugin Abtest Local File Inclusion via abtest_admin.php6.9 Medium
- brandfolderWordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php6.9 Medium
- jamie dharma bookingWordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php6.9 Medium
- henrique dias imdb profile widgetWordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php6.9 Medium
- kaymeephotography photocart linkWordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php6.9 Medium
- myasui wp vaultWP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter6.9 Medium
- plasmatizemedia recover exit for woocommerceRecover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter8.1 High
- androthemes cookiteerWordPress Cookiteer theme <= 1.4.8 - Local File Inclusion vulnerability8.1 High
- axiomthemes racquetWordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability8.1 High
- axiomthemes fermentioWordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability8.1 High
- axiomthemes spinWordPress Spin theme <= 1.8 - Local File Inclusion vulnerability8.1 High
- select-themes waverideWordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability8.1 High
- code supply co. blueprintWordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability8.1 High
- axiomthemes craftiWordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability8.1 High
- unboundstudio accordion faqWordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability7.5 High
- axiomthemes confidantWordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability8.1 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Local File Inclusion in Dashboard Module7.6 High
mautic/corePackagistMautic vulnerable to Path Traversal via Campaign Import9.9 Critical- No product listedAn issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote...8.0 High
- seedprod llc proWordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability7.5 High
- shazdeh query shortcodeQuery Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute7.5 High
- getkirby kirbyKirby: Pre-authentication path traversal and PHP file inclusion during user lookup8.8 High
- checkpoint quantum security gatewayIdentity Awareness Captive Portal - Unauthenticated Local File Inclusion7.5 High
- magentech sw coreWordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion9.4 Critical
- sigmaplugin advanced database cleaner – premiumAdvanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'8.8 High
- wp-with-spritz wp with spritzWordPress Plugin WP with Spritz 1.0 Remote File Inclusion8.7 High
- simple-fields simple fieldsSimple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath6.9 Medium
- processmakerProcessMaker 3.5.4 Local File Inclusion via Path Traversal6.9 Medium
- supsystic backupWordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion6.9 Medium
- ultimate member ultimate-memberWordPress Plugin ultimate-member 2.1.3 Local File Inclusion6.8 Medium
- rometheme rtmkitRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'8.8 High
- yiisoft yii2Yii 2: Local file inclusion via view parameter name collision7.4 High
- cab-fare-calculatorWordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion6.9 Medium
- gibbonedu gibbonGibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in...8.9 High
- livemesh addons by elementorLivemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter8.8 High
- froxlorFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution10.0 Critical
- boidcmsBoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter7.2 High
- No product listedA Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11...6.5 Medium
- cactusthemes videoproWordPress VideoPro theme <= 2.3.8.1 - Local File Inclusion vulnerability8.1 High
- case themes theme userWordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability7.5 High
- Show moreLoading…