CWE-98 · PHP Remote File Inclusion (page 2)
Page 2 of 13 — CVEs classified under CWE-98, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69147 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Putter <= 1.17 versions. |
CVE-2025-69146 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dom <= 1.24 versions. |
CVE-2025-69145 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gat <= 1.16 versions. |
CVE-2025-69143 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mission <= 1.22 versions. |
CVE-2025-69142 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Abelle <= 1.22 versions. |
CVE-2025-69141 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. |
CVE-2025-69136 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions. |
CVE-2025-69125 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. |
CVE-2025-69124 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Especio <= 1.0 versions. |
CVE-2025-69121 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. |
CVE-2025-69119 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. |
CVE-2025-69118 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. |
CVE-2025-69117 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
CVE-2025-69116 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. |
CVE-2025-69114 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. |
CVE-2025-69113 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. |
CVE-2025-69112 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. |
CVE-2025-69110 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. |
CVE-2025-69109 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. |
CVE-2025-69107 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. |
CVE-2025-69105 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. |
CVE-2025-60085 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. |
CVE-2025-58954 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions. |
CVE-2025-58953 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions. |
CVE-2025-58952 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. |
CVE-2025-58924 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Geya <= 1.15 versions. |
CVE-2025-49403 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions. |
CVE-2026-49954 | High | 7.2 | 2026-06-15 | Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code… |
CVE-2016-20082 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the acti… |
CVE-2016-20080 | Medium | 6.2 | 2026-06-15 | WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to inc… |
CVE-2016-20079 | Medium | 6.2 | 2026-06-15 | WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by m… |
CVE-2016-20078 | Medium | 6.2 | 2026-06-15 | WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating… |
CVE-2016-20077 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting i… |
CVE-2016-20064 | Medium | 6.2 | 2026-06-09 | WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped paramet… |
CVE-2026-9662 | High | 8.1 | 2026-06-09 | The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insuffici… |
CVE-2026-39553 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Loca… |
CVE-2026-39552 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP L… |
CVE-2025-69369 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local F… |
CVE-2025-68886 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local… |
CVE-2025-58897 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local… |
CVE-2025-58707 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File… |
CVE-2025-58705 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local Fi… |
CVE-2025-58024 | High | 7.5 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP… |
CVE-2025-53440 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local… |
CVE-2026-44239 | High | 8.8 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input w… |
CVE-2026-9559 | Critical | 9.9 | 2026-05-29 | A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the val… |
CVE-2026-37266 | High | 8.0 | 2026-05-28 | An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php compone… |
CVE-2026-48972 | High | 7.5 | 2026-05-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP L… |
CVE-2026-9200 | High | 7.5 | 2026-05-27 | The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This mak… |
CVE-2026-48133 | High | 7.5 | 2026-05-26 | When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Secur… |
CVE-2026-39661 | High | 7.5 | 2026-05-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local Fil… |
CVE-2026-8134 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
CVE-2026-39850 | High | 7.4 | 2026-05-20 | Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Loca… |
CVE-2026-7522 | High | 8.8 | 2026-05-20 | The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' p… |
CVE-2018-25329 | High | 7.5 | 2026-05-17 | WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting f… |
CVE-2018-25324 | Medium | 6.2 | 2026-05-17 | Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by… |
CVE-2021-47978 | Medium | 6.2 | 2026-05-16 | ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path trav… |
CVE-2020-37246 | Medium | 6.2 | 2026-05-16 | Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating t… |
CVE-2020-37169 | Medium | 5.5 | 2026-05-13 | WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipula… |
CVE-2026-3425 | High | 8.8 | 2026-05-13 | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter… |
CVE-2022-50954 | Medium | 6.2 | 2026-05-10 | WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manip… |
CVE-2026-8208 | | 2026-05-09 | Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing inte… | |
CVE-2026-41228 | Critical | 9.9 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid… |
CVE-2026-1620 | High | 8.8 | 2026-04-16 | The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insuffic… |
CVE-2026-39387 | High | 7.2 | 2026-04-14 | BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable t… |
CVE-2026-30480 | Medium | 6.5 | 2026-04-14 | A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbi… |
CVE-2025-5804 | High | 7.5 | 2026-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme… |
CVE-2025-58913 | High | 8.1 | 2026-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro videopro allows… |
CVE-2026-39684 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows… |
CVE-2026-39681 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local… |
CVE-2026-39679 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Loc… |
CVE-2026-39677 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires all… |
CVE-2026-39623 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP… |
CVE-2026-39613 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allo… |
CVE-2026-39611 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PH… |
CVE-2026-39544 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows P… |
CVE-2026-39538 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core… |
CVE-2026-34787 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80… |
CVE-2026-34036 | Medium | 6.5 | 2026-03-31 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local F… |
CVE-2018-25231 | Medium | 6.2 | 2026-03-30 | HeidiSQL 9.5.0.5196 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long file path… |
CVE-2026-32537 | High | 7.5 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & P… |
CVE-2026-32531 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local Fi… |
CVE-2026-32505 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Kiddy kiddy allows PHP Loca… |
CVE-2026-32504 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS VintWood vintwood allows PH… |
CVE-2026-32503 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Trendustry trendustry allow… |
CVE-2026-32500 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP… |
CVE-2026-27081 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows P… |
CVE-2026-27080 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Deston deston allows PHP… |
CVE-2026-27079 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows P… |
CVE-2026-27078 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Emaurri emaurri allows P… |
CVE-2026-27077 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes MultiOffice multioffice… |
CVE-2026-27076 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allo… |
CVE-2026-27075 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Belfort belfort allows P… |
CVE-2026-27048 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle Core theaisle-… |
CVE-2026-27047 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core al… |
CVE-2026-25464 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local… |
CVE-2026-25458 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows P… |
CVE-2026-25457 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows P… |
CVE-2026-25382 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows P… |
CVE-2026-25381 | High | 8.1 | 2026-03-25 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP… |