CWE-98— PHP Remote File Inclusion

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.— MITRE CWE catalog

1,359 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-98page 26 of 28

CVE-2024-54225HIGHCVSS 7.5EG 7.5
2024-12-09
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through <= 1.4.…
CVE-2024-53824HIGHCVSS 7.5EG 7.5
2024-12-06
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows PHP Local File Inclusion.This issue affects All …
CVE-2024-52501HIGHCVSS 7.5EG 7.5
2024-11-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through <= 1.3.0.
CVE-2024-52499HIGHCVSS 7.5EG 7.5
2024-11-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ibrahim Pricing table addon for elementor pricing-table-addon-for-elementor allows PHP Local File Inclusion.This issue…
CVE-2024-52497HIGHCVSS 7.5EG 7.5
2024-11-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in quomodosoft Shopready shopready-elementor-addon allows PHP Local File Inclusion.This issue affects Shopready: from n/a…
CVE-2024-52496HIGHCVSS 7.5EG 7.5
2024-11-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Local Code Inclusion.This issue affects Absolute …
CVE-2024-52450HIGHCVSS 7.5EG 7.5
2024-11-20
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in officialprocoders nBlocks nblocks allows PHP Local File Inclusion.This issue affects nBlocks: from n/a through <= 1.0.…
CVE-2024-50457HIGHCVSS 7.5EG 7.5
2024-10-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qode Essential Addons qode-essential-addons.This issue affects Qode Essential Addons: from n/a through <= 1.6.3.
CVE-2024-50436HIGHCVSS 7.5EG 7.5
2024-10-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Clean Retina clean-retina.This issue affects Clean Retina: from n/a through <= 3.0.6.
CVE-2024-50435HIGHCVSS 7.5EG 7.5
2024-10-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.
CVE-2024-50434HIGHCVSS 7.5EG 7.5
2024-10-28
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse NewsCard newscard.This issue affects NewsCard: from n/a through <= 1.3.
CVE-2024-49701HIGHCVSS 7.5EG 7.5
2024-10-23
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Mags mags.This issue affects Mags: from n/a through <= 1.1.6.
CVE-2024-49690HIGHCVSS 7.5EG 7.5
2024-10-23
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.2.
CVE-2024-49243HIGHCVSS 7.5EG 7.5
2024-10-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dynamic-elementor-addons allows PHP Local File Inclusion.This issue affects Dynamic …
CVE-2024-49317HIGHCVSS 7.5EG 7.5
2024-10-17
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through <= 0.1…
CVE-2024-49251HIGHCVSS 7.5EG 7.5
2024-10-16
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-elementor-addons allows Local Code Inclusion.This issue affects Maan Addons For E…
CVE-2024-48029HIGHCVSS 7.5EG 7.5
2024-10-16
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Rand…
CVE-2024-38735HIGHCVSS 7.5EG 7.5
2024-07-12
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.9.5.
CVE-2024-5574HIGHCVSS 7.5EG 7.5
2024-06-19
The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level…
CVE-2024-4887HIGHCVSS 7.5EG 7.5
2024-06-07
The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possib…
CVE-2024-3812HIGHCVSS 7.5EG 7.5
2024-05-18
The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_linea' attribute. This makes it possible for authenticated attackers, with contri…
CVE-2023-52325HIGHCVSS 7.5EG 7.5
2024-01-23
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. Please note: this vulnerability must be used in conjunction with anothe…
CVE-2023-31718HIGHCVSS 7.5EG 7.5
2023-09-22
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
CVE-2023-31716HIGHCVSS 7.5EG 7.5
2023-09-22
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
CVE-2022-44786HIGHCVSS 7.5EG 7.5
2022-11-21
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET request…
CVE-2022-41547HIGHCVSS 7.5EG 7.5
2022-10-18
Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP r…
CVE-2020-13175HIGHCVSS 7.5EG 7.5
2020-08-11
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows …
CVE-2019-5479HIGHCVSS 7.5EG 7.5
2019-09-03
An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).
CVE-2016-6565HIGHCVSS 7.5EG 7.5
2018-07-13
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, …
CVE-2026-39850HIGHCVSS 7.4EG 7.4
2026-05-20
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params_, EXTR_OVERWRITE) before t…
CVE-2024-51319HIGHCVSS 7.3EG 7.3
2025-03-11
A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp.
CVE-2026-49954HIGHCVSS 7.2EG 7.2
2026-06-15
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal…
CVE-2026-8134HIGHCVSS 7.2EG 7.2
2026-05-21
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing …
CVE-2026-39387HIGHCVSS 7.2EG 7.2
2026-04-14
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can …
CVE-2026-32401HIGHCVSS 7.2EG 7.2
2026-03-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client…
CVE-2015-10133HIGHCVSS 7.2EG 7.2
2025-07-19
The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include a…
CVE-2024-8392HIGHCVSS 7.2EG 7.2
2024-10-26
The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.6 via the 'tab' parameter. This makes it possible for authenticated attackers, …
CVE-2024-3061HIGHCVSS 7.2EG 7.2
2024-03-29
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attacker…
CVE-2021-22968HIGHCVSS 7.2EG 7.2
2021-11-19
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory e…
CVE-2026-71426HIGHCVSS 7.1EG 7.1
2026-10-01
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's …
CVE-2023-40033HIGHCVSS 7.1EG 7.1
2023-08-16
Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any F…
CVE-2024-58302MEDIUMCVSS 6.9EG 6.9
2025-12-11
FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to …
CVE-2026-88994MEDIUMCVSS 6.6EG 6.6
2026-09-18
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbi…
CVE-2026-14280MEDIUMCVSS 6.6EG 6.6
2026-08-25
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticat…
CVE-2026-66586MEDIUMCVSS 6.6EG 6.6
2026-08-20
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-17605MEDIUMCVSS 6.6EG 6.6
2026-08-01
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possibl…
CVE-2025-11977MEDIUMCVSS 6.6EG 6.6
2026-07-10
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_ge…
CVE-2026-13080MEDIUMCVSS 6.6EG 6.6
2026-07-09
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it p…
CVE-2025-66115MEDIUMCVSS 6.6EG 6.6
2025-11-21
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a throu…
CVE-2024-8393MEDIUMCVSS 6.6EG 6.6
2025-08-16
The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrat…

Map vulnerabilities like CWE-98 to your infrastructure

EchelonGraph correlates every CVE — across CWE-98 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →