# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-3061.md)
  `CVE-2024-3061` · CVE record: realmag777 HUSKY – Products Filter Professional for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 29 Mar 2024 · Tags: File inclusion
- [MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal](https://agentprime.io/advisories/CVE-2024-2411.md)
  `CVE-2024-2411` · CVE record: stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2024 · Tags: File inclusion
- [Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-1382.md)
  `CVE-2024-1382` · CVE record: nicdark Restaurant Reservations · CVSS 8.8 High · Not analysed yet · Published 7 Mar 2024 · Tags: File inclusion
- [Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2023-6989.md)
  `CVE-2023-6989` · CVE record: paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.57 · Not analysed yet · Published 5 Feb 2024 · Tags: File inclusion
- [PHP file inclusion in Trend Micro, Inc. Trend Micro Apex Central](https://agentprime.io/advisories/CVE-2023-52325.md)
  `CVE-2023-52325` · CVE record: Trend Micro, Inc. Trend Micro Apex Central · CVSS 7.5 High · Not analysed yet · Published 23 Jan 2024 · Tags: File inclusion
- [Remote file inclusion vulnerability in FireEye Central Management](https://agentprime.io/advisories/CVE-2024-0315.md)
  `CVE-2024-0315` · CVE record: FireEye FireEye Central Management · CVSS 6.6 Medium · Not analysed yet · Published 15 Jan 2024 · Tags: File inclusion
- [Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality](https://agentprime.io/advisories/CVE-2023-6583.md)
  `CVE-2023-6583` · CVE record: carazo Import and export users and customers · CVSS 6.6 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: File inclusion
- [Local File Inclusion (RCE) in Cacti](https://agentprime.io/advisories/CVE-2023-49084.md)
  `CVE-2023-49084` · CVE record: Cacti cacti · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.64 · Not analysed yet · Published 21 Dec 2023 · Tags: File inclusion
- [News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion](https://agentprime.io/advisories/CVE-2023-5815.md)
  `CVE-2023-5815` · CVE record: infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News · CVSS 8.1 High · Not analysed yet · Published 22 Nov 2023 · Tags: File inclusion
- [HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2023-5099.md)
  `CVE-2023-5099` · CVE record: jonashjalmarsson HTML filter and csv-file search · CVSS 8.8 High · Not analysed yet · Published 31 Oct 2023 · Tags: File inclusion
- [Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2023-5250.md)
  `CVE-2023-5250` · CVE record: g5theme Grid Plus – Unlimited grid layout · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2023 · Tags: File inclusion
- [PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode](https://agentprime.io/advisories/CVE-2023-5199.md)
  `CVE-2023-5199` · CVE record: bloafer PHP to Page · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2023 · Tags: File inclusion
- [Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2023-4488.md)
  `CVE-2023-4488` · CVE record: hyno Dropbox Folder Share · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2023 · Tags: File inclusion
- [FUXA local file inclusion vulnerability](https://agentprime.io/advisories/GHSA-wwfj-h843-3hrq.md)
  `GHSA-wwfj-h843-3hrq`, `CVE-2023-31718` · npm `fuxa-server`: affected `<=1.1.12`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2023 · Tags: File inclusion
- [FUXA vulnerable to Local File Inclusion](https://agentprime.io/advisories/GHSA-45c3-c4c3-8rqg.md)
  `GHSA-45c3-c4c3-8rqg`, `CVE-2023-31716` · npm `@frangoteam/fuxa`: affected `<=1.1.12`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2023 · Tags: File inclusion
- [Yii2 allows attackers to execute any local .php file via a relative path in the view parameter](https://agentprime.io/advisories/GHSA-7cfq-72w2-24q4.md)
  `GHSA-7cfq-72w2-24q4`, `CVE-2015-5467`, `PKSA-62sq-zmbb-yyr8`, `PKSA-vxs3-y9yw-z24k` · Packagist `yiisoft/yii2`: affected `>=2.0.0, <2.0.5`, fixed in `2.0.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2023 · Tags: Path traversal, File inclusion
- [An issue was discovered in Geomatika IsiGeo Web 6.0.](https://agentprime.io/advisories/CVE-2023-23565.md)
  `CVE-2023-23565` · CVE record · No CVSS score · Not analysed yet · Published 22 Aug 2023 · Tags: File inclusion
- [Flarum vulnerable to LFI and Blind SSRF via Avatar upload](https://agentprime.io/advisories/GHSA-67c6-q4j4-hccg.md)
  `GHSA-67c6-q4j4-hccg`, `CVE-2023-40033`, `PKSA-4zyn-nz6f-g7kq`, `PKSA-gy61-rznj-1v67` · Packagist `flarum/core` and 1 more: affected `<1.8.0`, fixed in `1.8.0` · CVSS 7.1 High · Not analysed yet · Published 16 Aug 2023 · Tags: File inclusion, Server-side request forgery (SSRF)
- [Canto <= 3.0.4 - Unauthenticated Remote File Inclusion](https://agentprime.io/advisories/CVE-2023-3452.md)
  `CVE-2023-3452` · CVE record: flightbycanto Canto · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2023 · Tags: File inclusion
- [Cockpit PHP Remote File Inclusion vulnerability](https://agentprime.io/advisories/GHSA-xcq3-7pf3-5jvc.md)
  `GHSA-xcq3-7pf3-5jvc`, `CVE-2023-4195`, `PKSA-ywbw-pgpj-12g6` · Packagist `cockpit-hq/cockpit`: affected `<2.6.3`, fixed in `2.6.3` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2023 · Tags: File inclusion
- [wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents](https://agentprime.io/advisories/CVE-2023-2249.md)
  `CVE-2023-2249` · CVE record: tomdever wpForo Forum · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.61 · Not analysed yet · Published 9 Jun 2023 · Tags: File inclusion
- [PHP Remote File Inclusion in unilogies/bumsys](https://agentprime.io/advisories/CVE-2023-2551.md)
  `CVE-2023-2551` · CVE record: unilogies unilogies/bumsys · CVSS 7.2 High · Not analysed yet · Published 5 May 2023 · Tags: File inclusion
- [AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.](https://agentprime.io/advisories/CVE-2023-24217.md)
  `CVE-2023-24217` · CVE record · CVSS 8.8 High · Not analysed yet · Published 6 Mar 2023 · Tags: File inclusion
- [PHP Remote File Inclusion in flatpressblog/flatpress](https://agentprime.io/advisories/CVE-2022-4606.md)
  `CVE-2022-4606` · CVE record: flatpressblog flatpressblog/flatpress · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 18 Dec 2022 · Tags: File inclusion
- [PHP Remote File Inclusion in tsolucio/corebos](https://agentprime.io/advisories/CVE-2022-4446.md)
  `CVE-2022-4446` · CVE record: tsolucio tsolucio/corebos · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2022 · Tags: File inclusion
- [An issue was discovered in Appalti & Contratti 9.12.2.](https://agentprime.io/advisories/CVE-2022-44786.md)
  `CVE-2022-44786` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Nov 2022 · Tags: File inclusion
- [MobSF allows attackers to read arbitrary files via a crafted HTTP request](https://agentprime.io/advisories/GHSA-f42p-vc8p-7x54.md)
  `GHSA-f42p-vc8p-7x54`, `CVE-2022-41547`, `PYSEC-2026-848` · PyPI `mobsf`: affected `<0.9.3`, fixed in `0.9.3` · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2022 · Tags: File inclusion
- [A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file.](https://agentprime.io/advisories/CVE-2022-40089.md)
  `CVE-2022-40089` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2022 · Tags: File inclusion
- [Remote file inclusion vulnerability in ArcGIS Server help documentation](https://agentprime.io/advisories/CVE-2021-29113.md)
  `CVE-2021-29113` · CVE record: Esri ArcGIS Server · CVSS 4.7 Medium · Not analysed yet · Published 7 Dec 2021 · Tags: File inclusion
- [Improper file handling in concrete5/core](https://agentprime.io/advisories/GHSA-g3p2-hfqr-9m25.md)
  `GHSA-g3p2-hfqr-9m25`, `CVE-2021-22968`, `PKSA-q3cr-p22c-s4q9` · Packagist `concrete5/core`: affected `<8.5.7`, fixed in `8.5.7` · CVSS 7.2 High · Not analysed yet · Published 23 Nov 2021 · Tags: File inclusion, Weak cryptography or TLS
- [PHP file inclusion in Advantech](https://agentprime.io/advisories/CVE-2021-21804.md)
  `CVE-2021-21804` · CVE record: Advantech · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2021 · Tags: File inclusion
- [PHP file inclusion in - Cloud Access Connector - Cloud Access Connector Legacy](https://agentprime.io/advisories/CVE-2020-13175.md)
  `CVE-2020-13175` · CVE record: \- Cloud Access Connector - Cloud Access Connector Legacy · No CVSS score · Not analysed yet · Published 11 Aug 2020 · Tags: File inclusion
- [Local File read vulnerability in OctoberCMS](https://agentprime.io/advisories/GHSA-r23f-c2j5-rx2f.md)
  `GHSA-r23f-c2j5-rx2f`, `CVE-2020-5295`, `PKSA-cdgw-bbb7-3jf8` · Packagist `october/cms`: affected `>=1.0.319, <1.0.466`, fixed in `1.0.466` · CVSS 4.8 Medium · Not analysed yet · Published 3 Jun 2020 · Tags: File inclusion, CWE-829
- [Unintended Require in larvitbase-api](https://agentprime.io/advisories/GHSA-xf27-jqwv-gf3r.md)
  `GHSA-xf27-jqwv-gf3r`, `CVE-2019-5479` · npm `larvitbase-api`: affected `<0.5.5`, fixed in `0.5.5` · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2019 · Tags: File inclusion, CWE-829
- [PHP file inclusion in Honeywell Experion PKS](https://agentprime.io/advisories/CVE-2014-9186.md)
  `CVE-2014-9186` · CVE record: Honeywell Experion PKS · No CVSS score · Not analysed yet · Published 8 Apr 2019 · Tags: File inclusion
- [PHP file inclusion in Schneider Electric Modicon PLC](https://agentprime.io/advisories/CVE-2015-6461.md)
  `CVE-2015-6461` · CVE record: Schneider Electric Modicon PLC · No CVSS score · Not analysed yet · Published 21 Mar 2019 · Tags: File inclusion
- [The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file](https://agentprime.io/advisories/CVE-2016-6565.md)
  `CVE-2016-6565` · CVE record: Imagely NextGen Gallery plugin · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: File inclusion
- [PHP file inclusion in Trend Micro Smart Protection Server (Standalone)](https://agentprime.io/advisories/CVE-2017-14095.md)
  `CVE-2017-14095` · CVE record: Trend Micro Trend Micro Smart Protection Server (Standalone) · No CVSS score · EPSS 0.12 · Not analysed yet · Published 19 Jan 2018 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI0LTAzLTMwVDA0OjMxOjA3LjY1NzAwMFoiLCJDVkUtMjAyNC0yMDQ3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI0LTAzLTMwVDA0OjMxOjA3LjY1NzAwMFoiLCJDVkUtMjAyNC0yMDQ3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.