Skip to content
CVE Tracker

CWE-98: PHP remote file inclusion

1,354 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 1,354 in the listAtom feed of new CVEsWhat CWE-98 is, at MITRE (opens in a new tab)
Published CVEs
1,354
Last 12 months
848
Critical
71
Known exploited
2

Critical 71High 1,218Medium 64Low 1Not scored 0

CVEs per yearBy the year they were published

  1. 20251
  2. 2026428
  3. 2026748
  4. 20268
  5. 20266
  6. 20264
  7. 20262
  8. 20263
  9. 20262
  10. 20268
  11. 20262
  12. 20261

Known exploitedNewest addition to KEV first

  • CVE-2026-87902

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

    WordPress · WordPress

    ExploitedHigh8.1
  • CVE-2025-68645

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of…

    Product not named

    ExploitedHigh8.8

Newest CVEs

  • CVE-2026-73695

    Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

    Control Web Panel · Control Web Panel

    High8.7
  • CVE-2026-62121

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

    Unlimited Elements · Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

    Medium6.5
  • CVE-2010-20125

    DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php

    DedeCMS · DedeCMS

    High8.7
  • CVE-2026-110185

    Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

    bitpressadmin · Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More

    Medium5.9
  • CVE-2014-125137

    C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

    C97net · qEngine CMS

    High7.1
  • CVE-2026-112850

    WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

    AncoraThemes · Your Dress

    High8.1
  • CVE-2026-112832

    WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

    CozyThemes · Rootblox

    Critical9.8
  • CVE-2017-20289

    Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

    Broadstreet · Ad Widget

    High7.7
  • CVE-2026-112820

    WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

    Elated-Themes · Academist Core

    High8.1
  • CVE-2016-20101

    Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

    Pedro Marcelo · Issuu Panel

    Critical9.2

Vendors it comes up for most

  1. ThemeREX157
  2. AncoraThemes118
  3. axiomthemes84
  4. Mikado-Themes50
  5. Elated-Themes36
  6. thembay34
  7. ThemeMove22
  8. Select-Themes20
  9. Edge-Themes11
  10. snstheme11