cve.bz

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (Remote file include), page 3

Filter

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

What the weakness is: CWE-98 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-98, as MITRE names them. Credits.

Ask an AI about CWE-98

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/98.html and https://cve.bz/cve/cwe/98?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-57793EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.

  2. 7.5CVE-2026-57792EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.

  3. 7.5CVE-2026-57791EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

  4. 7.5CVE-2026-57790EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

  5. 7.5CVE-2026-57789EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.

  6. 7.5CVE-2026-57788EPSS 0.5%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

  7. 8.1CVE-2026-57743EPSS 0.6%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Exten…

  8. 2.1CVE-2026-15540EPSS 0.4%

    A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page…

  9. 7.5CVE-2026-15338EPSS 1.0%

    The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with con…

  10. 6.6CVE-2025-11977EPSS 0.9%

    The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_…

  11. 6.6CVE-2026-13080EPSS 1.2%

    The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it pos…

  12. 2.3CVE-2026-12194EPSS 0.4%

    PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.

  13. 4.3CVE-2026-5137EPSS 0.4%

    The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX en…

  14. 7.5CVE-2026-57749EPSS 0.4%

    Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.

  15. 7.5CVE-2026-57748EPSS 0.4%

    Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

  16. 8.1CVE-2026-42382EPSS 0.5%

    Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

  17. 8.1CVE-2026-27412EPSS 0.5%

    Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

  18. 7.5CVE-2025-69133EPSS 0.4%

    Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

  19. 8.1CVE-2025-58902EPSS 0.5%

    Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

  20. 7.5CVE-2026-12923EPSS 0.5%

    The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/comm…

  21. 7.5CVE-2026-57647EPSS 0.4%

    Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

  22. 7.5CVE-2025-68064EPSS 0.4%

    Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

  23. 7.5CVE-2025-68063EPSS 0.4%

    Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

  24. 8.1CVE-2026-54845EPSS 0.5%

    Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

  25. 6.9CVE-2019-25760EPSS 0.5%

    Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the opt…

  26. 9.8CVE-2026-7515EPSS 0.9%

    The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php…

  27. 6.3CVE-2026-48820EPSS 0.3%

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element…

  28. 8.1CVE-2026-54814EPSS 0.3%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

  29. 8.1CVE-2026-39590EPSS 0.3%

    Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

  30. 8.1CVE-2026-39559EPSS 0.3%

    Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.

  31. 8.1CVE-2026-39523EPSS 0.3%

    Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.

  32. 8.1CVE-2025-69175EPSS 0.3%

    Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

  33. 8.1CVE-2025-69174EPSS 0.3%

    Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

  34. 8.1CVE-2025-69170EPSS 0.3%

    Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

  35. 8.1CVE-2025-69166EPSS 0.4%

    Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

  36. 8.1CVE-2025-69164EPSS 0.3%

    Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

  37. 8.1CVE-2025-69158EPSS 0.3%

    Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

  38. 8.1CVE-2025-69157EPSS 0.4%

    Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

  39. 8.1CVE-2025-69144EPSS 0.3%

    Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

  40. 8.1CVE-2025-69126EPSS 0.3%

    Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

  41. 8.1CVE-2025-69123EPSS 0.3%

    Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

  42. 8.1CVE-2025-69120EPSS 0.4%

    Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

  43. 8.1CVE-2025-69115EPSS 0.3%

    Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

  44. 8.1CVE-2025-69106EPSS 0.4%

    Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

  45. 8.1CVE-2026-40731EPSS 0.4%

    Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.

  46. 7.5CVE-2026-40721EPSS 0.4%

    Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

  47. 8.1CVE-2026-39582EPSS 0.3%

    Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

  48. 8.1CVE-2026-39568EPSS 0.4%

    Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

  49. 8.1CVE-2026-39558EPSS 0.3%

    Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

  50. 8.1CVE-2026-39549EPSS 0.4%

    Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.