CWE-98

High likelihood

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Parent: CWE-706 - Use of Incorrectly-Resolved Name or Reference

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

1,149 vulnerabilities with CWE-98
CVE-2026-27065 CRITICAL
WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability
CVSS 9.8
CVE-2026-27093 HIGH
WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability
CVSS 8.1
CVE-2026-29858 HIGH
aaPanel 7.57.0 - Local File Inclusion via Path Validation Bypass
CVSS 7.5
CVE-2026-1463 HIGH
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
CVSS 8.8
CVE-2026-27894 HIGH
LAM has Authenticated Local File Inclusion (LFI) in PDF export
CVSS 8.8
CVE-2026-32426 HIGH
Medilazar Core <1.4.7 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32401 HIGH
Sprout Invoices Client Invoicing <=20.8.9 - PHP RFI
CVSS 7.2
CVE-2026-32400 HIGH
Boldman <=7.7 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32393 HIGH
Greenly Theme Addons <8.2 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32392 HIGH
Creatives_Planet Greenly <=8.1 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32384 HIGH
WpBookingly <=1.2.9 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32369 HIGH
RadiusTheme Medilink-Core <2.0.7 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-32364 HIGH
Turbo Manager <4.0.8 - PHP Local File Inclusion
CVSS 7.5
CVE-2026-3826 CRITICAL
WellChoose organization_portal_system < iftop_p4_181 - Unauthenticated Local File Inclusion
CVSS 9.8
CVE-2026-28129 HIGH
Little Birdies <=1.3.16 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28128 HIGH
ThemeREX Verse <=1.7.0 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28125 HIGH
Midi <=1.14 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28124 HIGH
AncoraThemes Notarius <=1.9 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28123 HIGH
AncoraThemes Veil <=1.9 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28121 HIGH
AncoraThemes Anderson <=1.4.2 - PHP RFI
CVSS 8.1
CVE-2026-28120 HIGH
ThemeREX Dr.Patterson <=1.3.2 - PHP RFI
CVSS 8.1
CVE-2026-28119 HIGH
axiomthemes Nirvana <=2.6 - PHP RFI
CVSS 8.1
CVE-2026-28118 HIGH
Welldone <=2.4 - PHP Local File Inclusion
CVSS 8.1
CVE-2026-28117 HIGH
axiomthemes smart SEO <=2.9 - PHP RFI
CVSS 8.1
CVE-2026-28107 HIGH
ThemeREX Muzicon <=1.9.0 - PHP Local File Inclusion
CVSS 8.1
Details
Vulnerabilities 1,149
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits