cve.bz

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (Remote file include), page 4

Filter

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

What the weakness is: CWE-98 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-98, as MITRE names them. Credits.

Ask an AI about CWE-98

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/98.html and https://cve.bz/cve/cwe/98?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2026-39547EPSS 0.3%

    Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

  2. 8.1CVE-2026-39537EPSS 0.4%

    Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.

  3. 8.1CVE-2026-39522EPSS 0.4%

    Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

  4. 8.1CVE-2026-34895EPSS 0.3%

    Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.

  5. 8.1CVE-2026-34894EPSS 0.4%

    Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

  6. 8.1CVE-2026-34893EPSS 0.3%

    Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

  7. 8.1CVE-2026-22338EPSS 0.3%

    Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

  8. 8.1CVE-2026-22331EPSS 0.4%

    Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

  9. 8.1CVE-2026-22330EPSS 0.4%

    Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.

  10. 8.1CVE-2026-22326EPSS 0.3%

    Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.

  11. 8.1CVE-2026-22325EPSS 0.4%

    Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

  12. 8.1CVE-2025-69178EPSS 0.4%

    Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

  13. 8.1CVE-2025-69177EPSS 0.5%

    Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

  14. 8.1CVE-2025-69176EPSS 0.3%

    Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

  15. 8.1CVE-2025-69173EPSS 0.4%

    Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

  16. 8.1CVE-2025-69172EPSS 0.4%

    Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.

  17. 8.1CVE-2025-69171EPSS 0.3%

    Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

  18. 8.1CVE-2025-69168EPSS 0.4%

    Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

  19. 8.1CVE-2025-69167EPSS 0.4%

    Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

  20. 8.1CVE-2025-69165EPSS 0.4%

    Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

  21. 8.1CVE-2025-69163EPSS 0.4%

    Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.

  22. 8.1CVE-2025-69162EPSS 0.4%

    Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.

  23. 8.1CVE-2025-69161EPSS 0.3%

    Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

  24. 8.1CVE-2025-69160EPSS 0.4%

    Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

  25. 8.1CVE-2025-69159EPSS 0.4%

    Unauthenticated Local File Inclusion in Printo <= 1.11 versions.

  26. 8.1CVE-2025-69150EPSS 0.4%

    Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.

  27. 8.1CVE-2025-69149EPSS 0.4%

    Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

  28. 8.1CVE-2025-69148EPSS 0.4%

    Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

  29. 8.1CVE-2025-69147EPSS 0.4%

    Unauthenticated Local File Inclusion in Putter <= 1.17 versions.

  30. 8.1CVE-2025-69146EPSS 0.3%

    Unauthenticated Local File Inclusion in Dom <= 1.24 versions.

  31. 8.1CVE-2025-69145EPSS 0.3%

    Unauthenticated Local File Inclusion in Gat <= 1.16 versions.

  32. 8.1CVE-2025-69143EPSS 0.4%

    Unauthenticated Local File Inclusion in Mission <= 1.22 versions.

  33. 8.1CVE-2025-69142EPSS 0.4%

    Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.

  34. 8.1CVE-2025-69141EPSS 0.3%

    Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.

  35. 8.1CVE-2025-69136EPSS 0.4%

    Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.

  36. 8.1CVE-2025-69125EPSS 0.3%

    Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.

  37. 8.1CVE-2025-69124EPSS 0.4%

    Unauthenticated Local File Inclusion in Especio <= 1.0 versions.

  38. 8.1CVE-2025-69121EPSS 0.4%

    Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

  39. 8.1CVE-2025-69119EPSS 0.4%

    Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

  40. 8.1CVE-2025-69118EPSS 0.3%

    Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.

  41. 8.1CVE-2025-69117EPSS 0.4%

    Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

  42. 8.1CVE-2025-69116EPSS 0.4%

    Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.

  43. 8.1CVE-2025-69114EPSS 0.4%

    Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.

  44. 8.1CVE-2025-69113EPSS 0.4%

    Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

  45. 8.1CVE-2025-69112EPSS 0.4%

    Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

  46. 8.1CVE-2025-69110EPSS 0.4%

    Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

  47. 8.1CVE-2025-69109EPSS 0.4%

    Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

  48. 8.1CVE-2025-69107EPSS 0.4%

    Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.

  49. 8.1CVE-2025-69105EPSS 0.4%

    Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.

  50. 8.1CVE-2025-60085EPSS 0.4%

    Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.