CWE-98— PHP Remote File Inclusion
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.— MITRE CWE catalog
1,359 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-98page 7 of 28
- CVE-2026-32464HIGHCVSS 8.1EG 8.12026-08-18
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
- CVE-2026-28570HIGHCVSS 8.1EG 8.12026-08-18
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
- CVE-2026-66657HIGHCVSS 8.1EG 8.12026-08-13
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
- CVE-2026-66656HIGHCVSS 8.1EG 8.12026-08-13
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
- CVE-2026-66653HIGHCVSS 8.1EG 8.12026-08-13
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
- CVE-2026-66450HIGHCVSS 8.1EG 8.12026-08-13
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
- CVE-2026-66710HIGHCVSS 8.1EG 8.12026-08-06
Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
- CVE-2026-57743HIGHCVSS 8.1EG 8.12026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Exten…
- CVE-2026-27412HIGHCVSS 8.1EG 8.12026-07-02
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
- CVE-2026-42382HIGHCVSS 8.1EG 8.12026-07-02
Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
- CVE-2025-58902HIGHCVSS 8.1EG 8.12026-07-02
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
- CVE-2026-54845HIGHCVSS 8.1EG 8.12026-06-25
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
- CVE-2026-54814HIGHCVSS 8.1EG 8.12026-06-17
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.
- CVE-2026-39590HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.
- CVE-2026-39559HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
- CVE-2026-39523HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
- CVE-2025-69175HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
- CVE-2025-69174HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
- CVE-2025-69170HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
- CVE-2025-69166HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
- CVE-2025-69164HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
- CVE-2025-69158HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
- CVE-2025-69157HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
- CVE-2025-69144HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
- CVE-2025-69126HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
- CVE-2025-69123HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
- CVE-2025-69120HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
- CVE-2025-69115HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
- CVE-2025-69106HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.
- CVE-2026-40731HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
- CVE-2026-39582HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
- CVE-2026-39568HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
- CVE-2026-39558HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
- CVE-2026-39549HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
- CVE-2026-39547HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
- CVE-2026-39537HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
- CVE-2026-39522HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Solene <= 3.4 versions.
- CVE-2026-34895HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.
- CVE-2026-34894HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
- CVE-2026-34893HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.
- CVE-2026-22338HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.
- CVE-2026-22331HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.
- CVE-2026-22330HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.
- CVE-2026-22326HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
- CVE-2026-22325HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.
- CVE-2025-69178HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.
- CVE-2025-69177HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
- CVE-2025-69176HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
- CVE-2025-69173HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
- CVE-2025-69172HIGHCVSS 8.1EG 8.12026-06-17
Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.
Map vulnerabilities like CWE-98 to your infrastructure
EchelonGraph correlates every CVE — across CWE-98 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →