CWE-98: PHP remote file inclusion
1,358 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- 1,358Published CVEs1,358 of them scored
- 812Last 12 monthspublished in the last year
- 72Critical1,220 more rated high
- 2Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
WordPress · WordPress
ExploitedHigh8.1 - CVE-2025-68645
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of…
Product not named
ExploitedHigh8.8