CWE-98 · PHP Remote File Inclusion (page 13)
Page 13 of 13 — CVEs classified under CWE-98, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37410 | Medium | 4.9 | 2024-07-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in IdeaBox Creations PowerPack Lite for B… |
CVE-2024-37479 | High | 8.5 | 2024-07-02 | Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "pro… |
CVE-2024-5431 | High | 8.8 | 2024-06-25 | The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in al… |
CVE-2024-5455 | High | 8.8 | 2024-06-21 | The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'maga… |
CVE-2024-5503 | High | 8.8 | 2024-06-21 | The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for aut… |
CVE-2024-5574 | High | 7.5 | 2024-06-19 | The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' param… |
CVE-2024-4551 | Medium | 6.4 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-4258 | Critical | 9.8 | 2024-06-15 | The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including… |
CVE-2024-3813 | High | 8.8 | 2024-06-15 | The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'bl… |
CVE-2024-5577 | Critical | 9.8 | 2024-06-14 | The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the WIW_HEADER parameter of the /system/in… |
CVE-2024-4936 | Critical | 9.8 | 2024-06-14 | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it poss… |
CVE-2024-36415 | Critical | 9.1 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file ve… |
CVE-2024-35650 | Medium | 4.9 | 2024-06-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security mel… |
CVE-2024-4887 | High | 7.5 | 2024-06-07 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attribute… |
CVE-2024-35629 | Critical | 9.6 | 2024-06-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – R… |
CVE-2024-36569 | High | 8.1 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. |
CVE-2024-5348 | High | 8.8 | 2024-06-01 | The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'beforeafter_layout' at… |
CVE-2024-3564 | High | 8.8 | 2024-06-01 | The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's… |
CVE-2024-5345 | High | 8.8 | 2024-05-31 | The Responsive Owl Carousel for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.0 via the layout… |
CVE-2024-3812 | High | 7.5 | 2024-05-18 | The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectar_icon' shortcode 'icon_l… |
CVE-2024-3810 | High | 8.8 | 2024-05-18 | The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image'… |
CVE-2024-32523 | High | 8.1 | 2024-05-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EverPress Mailster mailster.This issue… |
CVE-2024-27971 | High | 8.3 | 2024-05-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager… |
CVE-2024-3551 | Critical | 9.8 | 2024-05-17 | The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter… |
CVE-2024-4670 | High | 8.8 | 2024-05-15 | The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form s… |
CVE-2024-33863 | Critical | 9.8 | 2024-05-14 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion. |
CVE-2024-4441 | High | 8.1 | 2024-05-14 | The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter… |
CVE-2024-3809 | High | 8.8 | 2024-05-14 | The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type'… |
CVE-2024-3808 | High | 8.8 | 2024-05-14 | The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolio… |
CVE-2024-3807 | High | 8.8 | 2024-05-14 | The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slides… |
CVE-2024-3806 | Critical | 9.8 | 2024-05-14 | The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes… |
CVE-2024-31459 | High | 8.0 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file… |
CVE-2024-34314 | Medium | 4.9 | 2024-05-07 | CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template… |
CVE-2024-3849 | High | 8.8 | 2024-05-02 | The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible fo… |
CVE-2024-3500 | High | 8.8 | 2024-05-02 | The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Adv… |
CVE-2024-3499 | High | 8.8 | 2024-05-02 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_naviga… |
CVE-2024-1600 | Critical | 9.3 | 2024-04-10 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exp… |
CVE-2024-3136 | Critical | 9.8 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This m… |
CVE-2024-30849 | Critical | 9.8 | 2024-04-05 | Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter i… |
CVE-2024-2047 | High | 8.8 | 2024-03-30 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw func… |
CVE-2024-3061 | High | 7.2 | 2024-03-29 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5… |
CVE-2024-2411 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This make… |
CVE-2024-1382 | High | 8.8 | 2024-03-07 | The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_rst_layout attribut… |
CVE-2023-6989 | Critical | 9.8 | 2024-02-05 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… |
CVE-2023-52325 | High | 7.5 | 2024-01-23 | A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installat… |
CVE-2024-0315 | Medium | 6.6 | 2024-01-15 | Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious P… |
CVE-2023-6583 | Medium | 6.6 | 2024-01-11 | The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurr… |
CVE-2023-49084 | High | 8.0 | 2023-12-21 | Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection… |
CVE-2023-5815 | High | 8.1 | 2023-11-22 | The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for… |
CVE-2023-5099 | High | 8.8 | 2023-10-31 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of… |
CVE-2023-5250 | High | 8.8 | 2023-10-30 | The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscri… |
CVE-2023-5199 | Critical | 9.9 | 2023-10-30 | The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' sh… |
CVE-2023-4488 | Critical | 9.8 | 2023-10-20 | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows… |
CVE-2023-31718 | High | 7.5 | 2023-09-22 | FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. |
CVE-2023-31716 | High | 7.5 | 2023-09-22 | FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log |
CVE-2023-23565 | Medium | 4.9 | 2023-08-22 | An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion. |
CVE-2023-3452 | Critical | 9.8 | 2023-08-12 | The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unaut… |
CVE-2023-4195 | High | 8.8 | 2023-08-06 | PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. |
CVE-2023-2249 | High | 8.8 | 2023-06-09 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and includi… |
CVE-2023-2551 | High | 8.8 | 2023-05-05 | PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1. |
CVE-2023-24217 | High | 8.8 | 2023-03-06 | AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability. |
CVE-2022-4606 | Critical | 9.8 | 2022-12-18 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4446 | Critical | 9.8 | 2022-12-13 | PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0. |
CVE-2022-44786 | High | 7.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to spec… |
CVE-2022-41547 | High | 7.5 | 2022-10-18 | Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script… |
CVE-2022-40089 | Critical | 9.8 | 2022-09-22 | A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerabilit… |
CVE-2021-29113 | Medium | 4.7 | 2021-12-07 | A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html int… |
CVE-2021-22968 | High | 7.2 | 2021-11-19 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 a… |
CVE-2021-21804 | Critical | 9.8 | 2021-07-16 | A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP… |
CVE-2020-13175 | High | 7.5 | 2020-08-11 | The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Clo… |
CVE-2020-5295 | Medium | 4.8 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an… |
CVE-2019-5479 | High | 7.5 | 2019-09-03 | An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). |
CVE-2014-9186 | Critical | 9.8 | 2019-04-08 | A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which c… |
CVE-2015-6461 | Medium | 5.4 | 2019-03-21 | Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BM… |
CVE-2016-6565 | High | 7.5 | 2018-07-13 | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request… |
CVE-2017-14095 | High | 8.1 | 2018-01-19 | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a lo… |