CWE-98

High likelihood

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

1,270 vulnerabilities with CWE-98
CVE-2026-34895 HIGH
WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-34894 HIGH
WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-34893 HIGH
WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-22338 HIGH
WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-22331 HIGH
WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-22330 HIGH
WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-22326 HIGH
WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-22325 HIGH
WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-49954 HIGH
Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory
CVSS 7.2
CVE-2026-9662 HIGH
Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
CVSS 8.1
CVE-2026-39553 HIGH
WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-39552 HIGH
WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-44239 HIGH
FreePBX: Authenticated Local File Inclusion in Dashboard Module
CVSS 8.8
CVE-2026-9559 CRITICAL
Mautic 7 - Authenticated Path Traversal and Remote Code Execution via Campaign Import ZIP Extraction
CVSS 9.9
CVE-2026-37266 HIGH
Responsive FileManager 9.14.0 - Remote Code Execution via force_download.php
CVSS 8.0
CVE-2026-48972 HIGH
WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability
CVSS 7.5
CVE-2026-9200 HIGH
Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
CVSS 7.5
CVE-2026-48133 HIGH
checkpoint Quantum Security Gateway - Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
CVSS 7.5
CVE-2026-39661 HIGH
WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability
CVSS 7.5
CVE-2026-8134 HIGH
Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion
CVSS 7.2
CVE-2026-39850 HIGH
Yii 2: Local file inclusion via view parameter name collision
CVSS 7.4
CVE-2026-7522 HIGH
Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
CVSS 8.8
CVE-2026-3425 HIGH
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
CVSS 8.8
CVE-2026-8208 HIGH
Gibbon < 30.0.01 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CVE-2026-41228 CRITICAL
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
CVSS 9.9
Details
Vulnerabilities 1,270
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits