CWE-98: Remote file include
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Also known as Improper Control of Filename for Include/Require Statement in PHP Program, RFI, Local file inclusion.
A kind of CWE-829 Inclusion of Functionality from Untrusted Control Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- invoiceplaneInvoicePlane: Missing CSRF Protection on State-Changing delete Actions7.5 High
- invoiceplaneInvoicePlane permits local file inclusion through the e-invoice XML configuration identifier7.5 High
- invoiceplaneInvoicePlane: Remote Code Execution via Writable Templates Directory9.1 Critical
- flippercode wp maps – google maps, openstreetmap, mapbox, store locator with search, filters & listingsWP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter7.5 High
- visual composer website builder, visualcomposer visual composer website builder +1 moreVisual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter9.8 Critical
- wordpress core, wordpress +1 moreWordPress Core Remote File Inclusion Vulnerability8.1 High
- wptravelengine wp travel engine – tour booking plugin – tour operator softwareWP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute7.5 High
- realmag777 husky – products filter for woocommerce professionalHUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX8.1 High
- miles all bootstrap blocksAll Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes6.6 Medium
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreLocal File Inclusion in /index.php/ajax/save_iodd_parameters8.8 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreLocal File Inclusion in /index.php/ajax/get_iodd_port_info8.8 High
- ninjew geo my wpGEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion7.5 High
- maxsite cmsMaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher8.8 High
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter7.5 High
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter7.5 High
- divi engine ajax filterDivi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter9.8 Critical
- elated-themes mane, måne +1 moreMåne <= 1.7 - Unauthenticated Local File Inclusion8.1 High
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys6.6 Medium
- liquidthemes magicai for wordpress - ai text, image, chat, code, and voice generatorWordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability8.8 High
- elated-themes måneWordPress Måne theme <= 1.7 - Local File Inclusion vulnerability8.1 High
- themewinter wp cafe proWordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability9.8 Critical
- select-themes tonda coreWordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability8.1 High
- select-themes tondaWordPress Tonda theme < 2.6 - Local File Inclusion vulnerability8.1 High
- elated-themes verdure coreWordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability8.1 High
- themewinter wp cafe proWordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability6.6 Medium
- uxper golo frameworkWordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability8.1 High
- edge themes shuffleWordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability8.1 High
- liedekef events made easyEvents Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property7.5 High
- smartdatasoft residoWordPress Resido theme <= 1.5 - Local File Inclusion vulnerability8.1 High
- jetmonsters restaurant menu by motopressWordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability8.1 High
- vladimir prelovac theme test driveWordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability8.1 High
- spabrice vavo coreWordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability8.1 High
- mikado themes biagiotti coreWordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability8.1 High
- mikado-themes foton coreWordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability8.1 High
- edge-themes baristaWordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability8.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability8.1 High
- e2pdfWordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability8.1 High
- stiofansisland payment forms, buy now buttons, and invoicing system | getpaidPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field6.6 Medium
- opensolution quick.cmsLocal File Inclusion in Quick.CMS5.1 Medium
- elated-themes vinoWordPress Vino theme <= 1.9 - Local File Inclusion vulnerability7.5 High
- select-themes tonda coreWordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability7.5 High
- emlogEmlog Local File Inclusion (LFI)7.7 High
- select-themes tondaWordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability7.5 High
- codexthemes thegem theme elements (for elementor)WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability7.5 High
- select-themes struktur coreWordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability7.5 High
- select-themes strukturWordPress Struktur theme < 2.7 - Local File Inclusion vulnerability7.5 High
- select-themes setsailWordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability7.5 High
- edge-themes overworldWordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability7.5 High
- uxper nussWordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability7.5 High
- saurabhsharma newsplus shortcodesWordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…