CWE-98 · PHP Remote File Inclusion (page 2)
Page 2 of 14 — CVEs classified under CWE-98, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40731 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. |
CVE-2026-40721 | High | 7.5 | 2026-06-17 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. |
CVE-2026-39582 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. |
CVE-2026-39568 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. |
CVE-2026-39558 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. |
CVE-2026-39549 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. |
CVE-2026-39547 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. |
CVE-2026-39537 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. |
CVE-2026-39522 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene <= 3.4 versions. |
CVE-2026-34895 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. |
CVE-2026-34894 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. |
CVE-2026-34893 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. |
CVE-2026-22338 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. |
CVE-2026-22331 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. |
CVE-2026-22330 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
CVE-2026-22326 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. |
CVE-2026-22325 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. |
CVE-2025-69178 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions. |
CVE-2025-69177 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions. |
CVE-2025-69176 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. |
CVE-2025-69173 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions. |
CVE-2025-69172 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Resurs <= 1.3 versions. |
CVE-2025-69171 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions. |
CVE-2025-69168 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Spike <= 1.2 versions. |
CVE-2025-69167 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eros <= 1.3 versions. |
CVE-2025-69165 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. |
CVE-2025-69163 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. |
CVE-2025-69162 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. |
CVE-2025-69161 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snowy <= 1.13 versions. |
CVE-2025-69160 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gita <= 1.11 versions. |
CVE-2025-69159 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Printo <= 1.11 versions. |
CVE-2025-69150 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Medeus <= 1.14 versions. |
CVE-2025-69149 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions. |
CVE-2025-69148 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Quirky <= 1.23 versions. |
CVE-2025-69147 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Putter <= 1.17 versions. |
CVE-2025-69146 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dom <= 1.24 versions. |
CVE-2025-69145 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gat <= 1.16 versions. |
CVE-2025-69143 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Mission <= 1.22 versions. |
CVE-2025-69142 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Abelle <= 1.22 versions. |
CVE-2025-69141 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. |
CVE-2025-69136 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions. |
CVE-2025-69125 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. |
CVE-2025-69124 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Especio <= 1.0 versions. |
CVE-2025-69121 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. |
CVE-2025-69119 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. |
CVE-2025-69118 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. |
CVE-2025-69117 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions. |
CVE-2025-69116 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. |
CVE-2025-69114 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. |
CVE-2025-69113 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. |
CVE-2025-69112 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. |
CVE-2025-69110 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. |
CVE-2025-69109 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. |
CVE-2025-69107 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. |
CVE-2025-69105 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. |
CVE-2025-60085 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. |
CVE-2025-58954 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions. |
CVE-2025-58953 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions. |
CVE-2025-58952 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. |
CVE-2025-58924 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Geya <= 1.15 versions. |
CVE-2025-49403 | High | 7.5 | 2026-06-17 | Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions. |
CVE-2026-49954 | High | 7.2 | 2026-06-15 | Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code… |
CVE-2016-20082 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the acti… |
CVE-2016-20080 | Medium | 6.2 | 2026-06-15 | WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to inc… |
CVE-2016-20079 | Medium | 6.2 | 2026-06-15 | WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by m… |
CVE-2016-20078 | Medium | 6.2 | 2026-06-15 | WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating… |
CVE-2016-20077 | Medium | 6.2 | 2026-06-15 | WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting i… |
CVE-2016-20064 | Medium | 6.2 | 2026-06-09 | WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped paramet… |
CVE-2026-9662 | High | 8.1 | 2026-06-09 | The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insuffici… |
CVE-2026-39553 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Loca… |
CVE-2026-39552 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP L… |
CVE-2025-69369 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local F… |
CVE-2025-68886 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local… |
CVE-2025-58897 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local… |
CVE-2025-58707 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File… |
CVE-2025-58705 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local Fi… |
CVE-2025-58024 | High | 7.5 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP… |
CVE-2025-53440 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local… |
CVE-2026-44239 | High | 8.8 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input w… |
CVE-2026-9559 | Critical | 9.9 | 2026-05-29 | A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the val… |
CVE-2026-37266 | High | 8.0 | 2026-05-28 | An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php compone… |
CVE-2026-48972 | High | 7.5 | 2026-05-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP L… |
CVE-2026-9200 | High | 7.5 | 2026-05-27 | The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This mak… |
CVE-2026-48133 | High | 7.5 | 2026-05-26 | When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Secur… |
CVE-2026-39661 | High | 7.5 | 2026-05-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local Fil… |
CVE-2026-8134 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
CVE-2026-39850 | High | 7.4 | 2026-05-20 | Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Loca… |
CVE-2026-7522 | High | 8.8 | 2026-05-20 | The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' p… |
CVE-2018-25329 | High | 7.5 | 2026-05-17 | WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting f… |
CVE-2018-25324 | Medium | 6.2 | 2026-05-17 | Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by… |
CVE-2021-47978 | Medium | 6.2 | 2026-05-16 | ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path trav… |
CVE-2020-37246 | Medium | 6.2 | 2026-05-16 | Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating t… |
CVE-2020-37169 | Medium | 5.5 | 2026-05-13 | WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipula… |
CVE-2026-3425 | High | 8.8 | 2026-05-13 | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter… |
CVE-2022-50954 | Medium | 6.2 | 2026-05-10 | WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manip… |
CVE-2026-8208 | | 2026-05-09 | Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing inte… | |
CVE-2026-41228 | Critical | 9.9 | 2026-04-23 | Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.update`) does not valid… |
CVE-2026-1620 | High | 8.8 | 2026-04-16 | The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insuffic… |
CVE-2026-39387 | High | 7.2 | 2026-04-14 | BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable t… |
CVE-2026-30480 | Medium | 6.5 | 2026-04-14 | A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbi… |