CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Description
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-193
CVEs mapped to this weakness (1,304)
page 64 of 66| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-57793 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8. | ||
| CVE-2026-57792 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1. | ||
| CVE-2026-57791 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0. | ||
| CVE-2026-57790 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8. | ||
| CVE-2026-57789 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2. | ||
| CVE-2026-57788 | Hig | 0.00 | 7.5 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8. | ||
| CVE-2026-57743 | Hig | 0.00 | 8.1 | 0.01 | Jul 13, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5. | ||
| CVE-2026-15540 | Med | 0.00 | 4.3 | 0.00 | Jul 13, 2026 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename… | ||
| CVE-2026-15338 | Hig | 0.00 | 7.5 | 0.01 | Jul 11, 2026 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to… | ||
| CVE-2025-11977 | Med | 0.00 | 6.6 | 0.01 | Jul 10, 2026 | The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it… | ||
| CVE-2026-13080 | Med | 0.00 | 6.6 | 0.01 | Jul 9, 2026 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers,… | ||
| CVE-2026-12194 | Low | 0.00 | — | 0.00 | Jul 4, 2026 | PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations. | ||
| CVE-2026-5137 | Med | 0.00 | 4.3 | 0.00 | Jul 3, 2026 | The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a… | ||
| CVE-2026-57749 | Hig | 0.00 | 7.5 | 0.00 | Jul 2, 2026 | Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions. | ||
| CVE-2026-57748 | Hig | 0.00 | 7.5 | 0.00 | Jul 2, 2026 | Contributor Local File Inclusion in Shopify <= 1.0.0 versions. | ||
| CVE-2026-42382 | Hig | 0.00 | 8.1 | 0.00 | Jul 2, 2026 | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | ||
| CVE-2026-27412 | Hig | 0.00 | 8.1 | 0.00 | Jul 2, 2026 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | ||
| CVE-2025-69133 | Hig | 0.00 | 7.5 | 0.00 | Jul 2, 2026 | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | ||
| CVE-2025-58902 | Hig | 0.00 | 8.1 | 0.00 | Jul 2, 2026 | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. | ||
| CVE-2026-12923 | Hig | 0.00 | 7.5 | 0.01 | Jul 1, 2026 | The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied… |
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.
- risk 0.00cvss 7.5epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.
- risk 0.00cvss 8.1epss 0.01
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
- risk 0.00cvss 4.3epss 0.00
A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename…
- risk 0.00cvss 7.5epss 0.01
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to…
- risk 0.00cvss 6.6epss 0.01
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it…
- risk 0.00cvss 6.6epss 0.01
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers,…
- risk 0.00cvss —epss 0.00
PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.
- risk 0.00cvss 4.3epss 0.00
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a…
- risk 0.00cvss 7.5epss 0.00
Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
- risk 0.00cvss 7.5epss 0.00
Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
- risk 0.00cvss 7.5epss 0.00
Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
- risk 0.00cvss 7.5epss 0.01
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied…