CWE-98— PHP Remote File Inclusion

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.— MITRE CWE catalog

1,359 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-98page 8 of 28

CVE-2025-69171HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
CVE-2025-69168HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
CVE-2025-69167HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Eros <= 1.3 versions.
CVE-2025-69165HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.
CVE-2025-69163HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
CVE-2025-69162HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
CVE-2025-69161HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
CVE-2025-69160HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Gita <= 1.11 versions.
CVE-2025-69159HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
CVE-2025-69150HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.
CVE-2025-69149HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
CVE-2025-69148HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
CVE-2025-69147HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Putter <= 1.17 versions.
CVE-2025-69146HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
CVE-2025-69145HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Gat <= 1.16 versions.
CVE-2025-69143HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Mission <= 1.22 versions.
CVE-2025-69142HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
CVE-2025-69141HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.
CVE-2025-69136HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.
CVE-2025-69125HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.
CVE-2025-69124HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
CVE-2025-69121HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.
CVE-2025-69119HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
CVE-2025-69118HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
CVE-2025-69117HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.
CVE-2025-69116HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
CVE-2025-69114HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
CVE-2025-69113HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVE-2025-69112HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
CVE-2025-69110HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
CVE-2025-69109HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
CVE-2025-69107HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
CVE-2025-69105HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
CVE-2025-60085HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.
CVE-2025-58954HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.
CVE-2025-58953HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.
CVE-2025-58952HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.
CVE-2025-58924HIGHCVSS 8.1EG 8.1
2026-06-17
Unauthenticated Local File Inclusion in Geya <= 1.15 versions.
CVE-2026-9662HIGHCVSS 8.1EG 8.1
2026-06-09
The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter befo…
CVE-2026-39553HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
CVE-2026-39552HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
CVE-2025-69369HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
CVE-2025-68886HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.
CVE-2025-58897HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.
CVE-2025-58707HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.
CVE-2025-58705HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.
CVE-2025-53440HIGHCVSS 8.1EG 8.1
2026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4.
CVE-2025-58913HIGHCVSS 8.1EG 8.1
2026-04-10
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro videopro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through <= 2.3.8.…
CVE-2026-32531HIGHCVSS 8.1EG 8.1
2026-03-25
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through < 1.4.5.
CVE-2026-32505HIGHCVSS 8.1EG 8.1
2026-03-25
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Kiddy kiddy allows PHP Local File Inclusion.This issue affects Kiddy: from n/a through <= 2.0.8.

Map vulnerabilities like CWE-98 to your infrastructure

EchelonGraph correlates every CVE — across CWE-98 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →