CWE-98
CWE-98 · 60 records · 13 with a public proof-of-concept
Records the NVD classes under CWE-98, highest CVSS first.
- CRITICAL 9.9CVE-2026-71550public PoC
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved fil…
- CRITICAL 9.8CVE-2026-112832
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
- CRITICAL 9.8CVE-2026-62032
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
- CRITICAL 9.8CVE-2026-12227
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary…
- CRITICAL 9.1CVE-2026-39353public PoC
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlle…
- HIGH 8.8CVE-2026-120841
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
- HIGH 8.8CVE-2026-120839
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
- HIGH 8.8CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an …
- HIGH 8.8CVE-2026-96837
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
- HIGH 8.8CVE-2026-27556
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
- HIGH 8.8CVE-2026-27555
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.
- HIGH 8.1CVE-2026-112850
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.
- HIGH 8.1CVE-2026-112820
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.
- HIGH 8.1CVE-2016-20101public PoC
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-do…
- HIGH 8.1CVE-2026-104909
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitra…
- HIGH 8.1CVE-2026-103367
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers…
- HIGH 8.1CVE-2026-104995
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_dir…
- HIGH 8.1CVE-2026-66566
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
- HIGH 8.1CVE-2026-62115
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
- HIGH 8.1CVE-2026-62099
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
- HIGH 8.1CVE-2026-62096
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
- HIGH 8.1CVE-2026-62094
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
- HIGH 8.1CVE-2026-62092
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
- HIGH 8.1CVE-2026-62075
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
- HIGH 8.1CVE-2026-62074
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
- HIGH 8.1CVE-2026-62070
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
- HIGH 8.1CVE-2026-62069
Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
- HIGH 8.1CVE-2026-62068
Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
- HIGH 8.1CVE-2026-62067
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
- HIGH 8.1CVE-2026-62066
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
- HIGH 8.1CVE-2026-62065
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
- HIGH 8.1CVE-2026-62020
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
- HIGH 8.1CVE-2026-48194
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
- HIGH 8.1CVE-2026-48193
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
- HIGH 8.1CVE-2026-42777
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
- HIGH 8.1CVE-2026-42724
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
- HIGH 8.1CVE-2026-42704
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
- HIGH 8.1CVE-2026-104899public PoC
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for una…
- HIGH 8.1CVE-2026-94067
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.
- HIGH 8.1CVE-2026-94062
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
- HIGH 8.1CVE-2026-87902public PoC
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to …
wordpress
- HIGH 8.1CVE-2026-92969
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to inc…
- HIGH 7.5CVE-2010-20125public PoC
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path trav…
- HIGH 7.5CVE-2017-20289public PoC
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can su…
- HIGH 7.5CVE-2026-110284
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llm…
- HIGH 7.5CVE-2026-75028
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attack…
- HIGH 7.5CVE-2026-92174
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and abo…
- HIGH 7.5CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level acce…
- HIGH 7.5CVE-2026-50547public PoC
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting P…
- HIGH 7.5CVE-2026-49850public PoC
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF…
- HIGH 7.5CVE-2026-13456
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authe…
- HIGH 7.5CVE-2026-9231
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, wi…
- MEDIUM 6.5CVE-2026-62121
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local Fil…
- MEDIUM 6.5CVE-2014-125137public PoC
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the ru…
- MEDIUM 6.5CVE-2026-113402
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
- MEDIUM 6.5CVE-2026-111829
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
- MEDIUM 5.9CVE-2026-119616public PoC
The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauth…
- MEDIUM 5.9CVE-2026-110185
The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageH…
- MEDIUM 5.3CVE-2026-62858public PoC
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before…
- UNSCOREDCVE-2026-71426public PoC
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. O…