CWE-98 · PHP Remote File Inclusion

1276 CVEs classified under CWE-98 (PHP Remote File Inclusion). Browse by severity and year.

Top CVEs for CWE-98
CVESeverityScorePublishedSummary
CVE-2025-25174Critical10.02025-08-14Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beete…
CVE-2025-52562Critical10.02025-06-23Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the Loca…
CVE-2026-9559Critical9.92026-05-29A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the val…
CVE-2026-41228Critical9.92026-04-23Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid…
CVE-2023-5199Critical9.92023-10-30The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' sh…
CVE-2026-7515Critical9.82026-06-19The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes…
CVE-2026-27065Critical9.82026-03-19Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress al…
CVE-2026-3826Critical9.82026-03-11IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.
CVE-2026-28043Critical9.82026-03-05Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Med…
CVE-2026-0926Critical9.82026-02-19The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]'…
CVE-2021-47900Critical9.82026-01-27Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands throu…
CVE-2025-14502Critical9.82026-01-14The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template paramet…
CVE-2025-53433Critical9.82025-12-18Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes EasyEat easyeat allows PH…
CVE-2025-65656Critical9.82025-12-02dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
CVE-2025-63888Critical9.82025-11-20The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
CVE-2025-41734Critical9.82025-11-18An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.
CVE-2025-11023Critical9.82025-10-23Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion…
CVE-2025-7634Critical9.82025-10-09The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu…
CVE-2025-7721Critical9.82025-10-03The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ…
CVE-2025-48293Critical9.82025-08-14Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allo…
All CVEs classified under CWE-98 — newest first (page 1 of 13)
CVESeverityScorePublishedSummary
CVE-2026-66657High8.12026-08-13Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVE-2026-66656High8.12026-08-13Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVE-2026-66653High8.12026-08-13Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66450High8.12026-08-13Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
CVE-2026-66710High8.12026-08-06Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
CVE-2026-17605Medium6.62026-08-01The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ…
CVE-2026-633022026-07-28Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can includ…
CVE-2026-65481High7.52026-07-23Contributor Local File Inclusion in Vino <= 1.9 versions.
CVE-2026-65477High7.52026-07-23Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
CVE-2026-441772026-07-16Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resul…
CVE-2026-466872026-07-16Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_co…
CVE-2026-57805High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP L…
CVE-2026-57804High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for…
CVE-2026-57803High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP…
CVE-2026-57802High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Loca…
CVE-2026-57801High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows P…
CVE-2026-57800High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows…
CVE-2026-57799High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File…
CVE-2026-57798High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes news…
CVE-2026-57796High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local…
CVE-2026-57795High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP…
CVE-2026-57794High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework al…
CVE-2026-57793High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Loc…
CVE-2026-57792High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local…
CVE-2026-57791High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local…
CVE-2026-57790High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Loc…
CVE-2026-57789High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local F…
CVE-2026-57788High7.52026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Loc…
CVE-2026-57743High8.12026-07-13Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e…
CVE-2026-15540Medium4.32026-07-13A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co…
CVE-2026-15338High7.52026-07-11The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type…
CVE-2025-11977Medium6.62026-07-10The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File…
CVE-2026-13080Medium6.62026-07-09The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up t…
CVE-2026-121942026-07-04PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on t…
CVE-2026-5137Medium4.32026-07-03The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insuffic…
CVE-2026-57749High7.52026-07-02Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
CVE-2026-57748High7.52026-07-02Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
CVE-2026-42382High8.12026-07-02Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
CVE-2026-27412High8.12026-07-02Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
CVE-2025-69133High7.52026-07-02Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
CVE-2025-58902High8.12026-07-02Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
CVE-2026-12923High7.52026-07-01The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validatio…
CVE-2026-57647High7.52026-06-26Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
CVE-2025-68064High7.52026-06-26Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
CVE-2025-68063High7.52026-06-26Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
CVE-2026-54845High8.12026-06-25Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
CVE-2019-25760Medium6.22026-06-19Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base…
CVE-2026-7515Critical9.82026-06-19The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes…
CVE-2026-488202026-06-17CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 thr…
CVE-2026-54814High8.12026-06-17Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local…
CVE-2026-39590High8.12026-06-17Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.
CVE-2026-39559High8.12026-06-17Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
CVE-2026-39523High8.12026-06-17Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
CVE-2025-69175High8.12026-06-17Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
CVE-2025-69174High8.12026-06-17Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
CVE-2025-69170High8.12026-06-17Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
CVE-2025-69166High8.12026-06-17Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
CVE-2025-69164High8.12026-06-17Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVE-2025-69158High8.12026-06-17Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
CVE-2025-69157High8.12026-06-17Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
CVE-2025-69144High8.12026-06-17Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
CVE-2025-69126High8.12026-06-17Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
CVE-2025-69123High8.12026-06-17Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
CVE-2025-69120High8.12026-06-17Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
CVE-2025-69115High8.12026-06-17Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
CVE-2025-69106High8.12026-06-17Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.
CVE-2026-40731High8.12026-06-17Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
CVE-2026-40721High7.52026-06-17Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
CVE-2026-39582High8.12026-06-17Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
CVE-2026-39568High8.12026-06-17Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
CVE-2026-39558High8.12026-06-17Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
CVE-2026-39549High8.12026-06-17Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
CVE-2026-39547High8.12026-06-17Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
CVE-2026-39537High8.12026-06-17Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
CVE-2026-39522High8.12026-06-17Unauthenticated Local File Inclusion in Solene <= 3.4 versions.
CVE-2026-34895High8.12026-06-17Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.
CVE-2026-34894High8.12026-06-17Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
CVE-2026-34893High8.12026-06-17Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.
CVE-2026-22338High8.12026-06-17Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.
CVE-2026-22331High8.12026-06-17Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.
CVE-2026-22330High8.12026-06-17Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.
CVE-2026-22326High8.12026-06-17Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
CVE-2026-22325High8.12026-06-17Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.
CVE-2025-69178High8.12026-06-17Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.
CVE-2025-69177High8.12026-06-17Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
CVE-2025-69176High8.12026-06-17Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
CVE-2025-69173High8.12026-06-17Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
CVE-2025-69172High8.12026-06-17Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.
CVE-2025-69171High8.12026-06-17Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
CVE-2025-69168High8.12026-06-17Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
CVE-2025-69167High8.12026-06-17Unauthenticated Local File Inclusion in Eros <= 1.3 versions.
CVE-2025-69165High8.12026-06-17Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.
CVE-2025-69163High8.12026-06-17Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
CVE-2025-69162High8.12026-06-17Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
CVE-2025-69161High8.12026-06-17Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
CVE-2025-69160High8.12026-06-17Unauthenticated Local File Inclusion in Gita <= 1.11 versions.
CVE-2025-69159High8.12026-06-17Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
CVE-2025-69150High8.12026-06-17Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.
CVE-2025-69149High8.12026-06-17Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
CVE-2025-69148High8.12026-06-17Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.