CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

VariantDraftLikelihood: High

Description

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-193

CVEs mapped to this weakness (1,304)

page 9 of 66

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2025-69165	WordPress Choreo	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.
CVE-2025-69163	WordPress Wineshop	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
CVE-2025-69162	WordPress Grecko	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
CVE-2025-69161	WordPress Snowy	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
CVE-2025-69160	WordPress Gita	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Gita <= 1.11 versions.
CVE-2025-69159	WordPress Printo	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
CVE-2025-69150	WordPress Medeus	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.
CVE-2025-69149	WordPress Top Dog	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
CVE-2025-69148	WordPress Quirky	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
CVE-2025-69147	WordPress Putter	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Putter <= 1.17 versions.
CVE-2025-69146	WordPress Dom	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
CVE-2025-69145	WordPress Gat	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Gat <= 1.16 versions.
CVE-2025-69143	WordPress Mission	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Mission <= 1.22 versions.
CVE-2025-69142	WordPress Abelle	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
CVE-2025-69141	WordPress Kelly Young	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.
CVE-2025-69136	WordPress Wanium	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.
CVE-2025-69125	WordPress Food Drop	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.
CVE-2025-69124	WordPress Especio	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
CVE-2025-69121	WordPress Deliciosa	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.
CVE-2025-69119	WordPress Corbesier	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

CVE-2025-69165HigJun 17, 2026
WordPress
Choreo
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.
CVE-2025-69163HigJun 17, 2026
WordPress
Wineshop
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
CVE-2025-69162HigJun 17, 2026
WordPress
Grecko
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
CVE-2025-69161HigJun 17, 2026
WordPress
Snowy
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
CVE-2025-69160HigJun 17, 2026
WordPress
Gita
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Gita <= 1.11 versions.
CVE-2025-69159HigJun 17, 2026
WordPress
Printo
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
CVE-2025-69150HigJun 17, 2026
WordPress
Medeus
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.
CVE-2025-69149HigJun 17, 2026
WordPress
Top Dog
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
CVE-2025-69148HigJun 17, 2026
WordPress
Quirky
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
CVE-2025-69147HigJun 17, 2026
WordPress
Putter
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Putter <= 1.17 versions.
CVE-2025-69146HigJun 17, 2026
WordPress
Dom
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
CVE-2025-69145HigJun 17, 2026
WordPress
Gat
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Gat <= 1.16 versions.
CVE-2025-69143HigJun 17, 2026
WordPress
Mission
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mission <= 1.22 versions.
CVE-2025-69142HigJun 17, 2026
WordPress
Abelle
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
CVE-2025-69141HigJun 17, 2026
WordPress
Kelly Young
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.
CVE-2025-69136HigJun 17, 2026
WordPress
Wanium
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.
CVE-2025-69125HigJun 17, 2026
WordPress
Food Drop
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.
CVE-2025-69124HigJun 17, 2026
WordPress
Especio
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
CVE-2025-69121HigJun 17, 2026
WordPress
Deliciosa
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.
CVE-2025-69119HigJun 17, 2026
WordPress
Corbesier
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.