# File inclusion. A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-8392.md) `CVE-2024-8392` · CVE record: delabon WordPress Post Grid Layouts with Pagination – Sogrid · CVSS 7.2 High · Not analysed yet · Published 26 Oct 2024 · Tags: File inclusion - [WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-49690.md) `CVE-2024-49690` · CVE record: Qode Qi Blocks · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2024 · Tags: File inclusion - [WordPress Mags theme <= 1.1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-49701.md) `CVE-2024-49701` · CVE record: themehorse Mags · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2024 · Tags: File inclusion - [WordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-49243.md) `CVE-2024-49243` · CVE record: ramjon27 Dynamic Elementor Addons · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2024 · Tags: File inclusion - [WordPress Point Maker plugin <= 0.1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-49317.md) `CVE-2024-49317` · CVE record: ZIPANG Point Maker · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2024 · Tags: File inclusion - [WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-48029.md) `CVE-2024-48029` · CVE record: Hung Trang Si SB Random Posts Widget · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2024 · Tags: File inclusion - [WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-49251.md) `CVE-2024-49251` · CVE record: Acnoo Maan Addons For Elementor · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2024 · Tags: File inclusion - [FormosaSoft ee-class - Local File Inclusion](https://agentprime.io/advisories/CVE-2024-9981.md) `CVE-2024-9981` · CVE record: FormosaSoft ee-class · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2024 · Tags: File inclusion - [WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-47323.md) `CVE-2024-47323` · CVE record: Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2024 · Tags: File inclusion - [WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-44023.md) `CVE-2024-44023` · CVE record: abcapp ABCApp Creator · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2024 · Tags: File inclusion - [Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion](https://agentprime.io/advisories/CVE-2024-41925.md) `CVE-2024-41925` · CVE record: Optigo Networks ONS-S8 Spectra Aggregation Switch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2024 · Tags: File inclusion - [WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-44048.md) `CVE-2024-44048` · CVE record: wpWax Product Carousel Slider & Grid Ultimate for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2024 · Tags: File inclusion - [Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-8252.md) `CVE-2024-8252` · CVE record: hornero Clean Login · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2024 · Tags: File inclusion - [Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-5762.md) `CVE-2024-5762` · CVE record: Zen Cart Zen Cart · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.72 · Not analysed yet · Published 21 Aug 2024 · Tags: File inclusion - [WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-43261.md) `CVE-2024-43261` · CVE record: Hamed Naderfar Compute Links · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2024 · Tags: File inclusion - [Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read](https://agentprime.io/advisories/CVE-2024-4359.md) `CVE-2024-4359` · CVE record: bdthemes Element Pack – Widgets, Templates & Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 9 Aug 2024 · Tags: File inclusion - [LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-6589.md) `CVE-2024-6589` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.8 High · Not analysed yet · Published 25 Jul 2024 · Tags: File inclusion - [PHP file inclusion in Atlassian Bamboo Data Center and others](https://agentprime.io/advisories/CVE-2024-21687.md) `CVE-2024-21687` · CVE record: Atlassian Bamboo Data Center and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2024 · Tags: File inclusion - [WordPress Event post plugin <= 5.9.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-38735.md) `CVE-2024-38735` · CVE record: Bastien Ho Event post · CVSS 7.5 High · Not analysed yet · Published 12 Jul 2024 · Tags: File inclusion - [WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-37520.md) `CVE-2024-37520` · CVE record: RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: File inclusion - [WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-37410.md) `CVE-2024-37410` · CVE record: IdeaBox Creations PowerPack Lite for Beaver Builder · CVSS 4.9 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: File inclusion - [WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-37479.md) `CVE-2024-37479` · CVE record: LA-Studio LA-Studio Element Kit for Elementor · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2024 · Tags: File inclusion - [WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-5431.md) `CVE-2024-5431` · CVE record: arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System · CVSS 8.8 High · Not analysed yet · Published 25 Jun 2024 · Tags: File inclusion - [The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-5455.md) `CVE-2024-5455` · CVE record: posimyththemes The Plus Addons for Elementor Page Builder Pro · CVSS 8.8 High · Not analysed yet · Published 21 Jun 2024 · Tags: File inclusion - [WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion](https://agentprime.io/advisories/CVE-2024-5503.md) `CVE-2024-5503` · CVE record: codevibrant WP Blog Post Layouts · CVSS 8.8 High · Not analysed yet · Published 21 Jun 2024 · Tags: File inclusion - [WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-5574.md) `CVE-2024-5574` · CVE record: codevibrant WP Magazine Modules Lite · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2024 · Tags: File inclusion - [Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-4551.md) `CVE-2024-4551` · CVE record: yotuwp Video Gallery – YouTube Playlist, Channel Gallery by YotuWP · CVSS 6.4 Medium · Not analysed yet · Published 15 Jun 2024 · Tags: File inclusion - [Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2024-4258.md) `CVE-2024-4258` · CVE record: yotuwp Video Gallery – YouTube Playlist, Channel Gallery by YotuWP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2024 · Tags: File inclusion - [tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-3813.md) `CVE-2024-3813` · CVE record: tagDiv tagDiv Composer · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2024 · Tags: File inclusion - [Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion](https://agentprime.io/advisories/CVE-2024-5577.md) `CVE-2024-5577` · CVE record: mcnardelli Where I Was, Where I Will Be · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jun 2024 · Tags: File inclusion - [Canto <= 3.0.8 - Unauthenticated Remote File Inclusion](https://agentprime.io/advisories/CVE-2024-4936.md) `CVE-2024-4936` · CVE record: flightbycanto Canto · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jun 2024 · Tags: File inclusion - [SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution](https://agentprime.io/advisories/CVE-2024-36415.md) `CVE-2024-36415` · CVE record: salesagility SuiteCRM · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: File inclusion, Unrestricted file upload - [WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-35650.md) `CVE-2024-35650` · CVE record: Melapress MelaPress Login Security · CVSS 4.9 Medium · Not analysed yet · Published 10 Jun 2024 · Tags: File inclusion - [Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-4887.md) `CVE-2024-4887` · CVE record: qodeinteractive Qi Addons For Elementor · CVSS 7.5 High · Not analysed yet · Published 7 Jun 2024 · Tags: File inclusion - [WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-35629.md) `CVE-2024-35629` · CVE record: Wow-Company Easy Digital Downloads – Recent Purchases · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2024 · Tags: File inclusion - [Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.](https://agentprime.io/advisories/CVE-2024-36569.md) `CVE-2024-36569` · CVE record · CVSS 8.1 High · Not analysed yet · Published 3 Jun 2024 · Tags: File inclusion - [Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes](https://agentprime.io/advisories/CVE-2024-5348.md) `CVE-2024-5348` · CVE record: nicdark Elements For Elementor · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2024 · Tags: File inclusion - [Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-3564.md) `CVE-2024-3564` · CVE record: vanderwijk Content Blocks (Custom Post Widget) · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2024 · Tags: File inclusion - [Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion](https://agentprime.io/advisories/CVE-2024-5345.md) `CVE-2024-5345` · CVE record: thenahidul Responsive Owl Carousel for Elementor · CVSS 8.8 High · Not analysed yet · Published 31 May 2024 · Tags: File inclusion - [Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-3812.md) `CVE-2024-3812` · CVE record: ThemeNectar Salient Core · CVSS 7.5 High · Not analysed yet · Published 18 May 2024 · Tags: File inclusion - [Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-3810.md) `CVE-2024-3810` · CVE record: ThemeNectar Salient Shortcodes · CVSS 8.8 High · Not analysed yet · Published 18 May 2024 · Tags: File inclusion - [WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-32523.md) `CVE-2024-32523` · CVE record: EverPress Mailster · CVSS 8.1 High · Not analysed yet · Published 17 May 2024 · Tags: File inclusion - [WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2024-27971.md) `CVE-2024-27971` · CVE record: Premmerce Premmerce Permalink Manager for WooCommerce · CVSS 8.3 High · Not analysed yet · Published 17 May 2024 · Tags: File inclusion - [Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2024-3551.md) `CVE-2024-3551` · CVE record: pencidesign Penci Soledad Data Migrator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2024 · Tags: File inclusion - [All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode](https://agentprime.io/advisories/CVE-2024-4670.md) `CVE-2024-4670` · CVE record: plugins360 All-in-One Video Gallery · CVSS 8.8 High · Not analysed yet · Published 15 May 2024 · Tags: File inclusion - [An issue was discovered in linqi before 1.4.0.1 on Windows.](https://agentprime.io/advisories/CVE-2024-33863.md) `CVE-2024-33863` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: File inclusion - [Cacti RCE vulnerability by file include in lib/plugin.php](https://agentprime.io/advisories/CVE-2024-31459.md) `CVE-2024-31459` · CVE record: Cacti cacti · CVSS 8.1 High · Not analysed yet · Published 13 May 2024 · Tags: File inclusion - [Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2024-3808.md) `CVE-2024-3808` · CVE record: P-THEMES Porto Theme - Functionality · CVSS 8.8 High · Not analysed yet · Published 9 May 2024 · Tags: File inclusion - [Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta](https://agentprime.io/advisories/CVE-2024-3809.md) `CVE-2024-3809` · CVE record: P-THEMES Porto Theme - Functionality · CVSS 8.8 High · Not analysed yet · Published 9 May 2024 · Tags: File inclusion - [Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts](https://agentprime.io/advisories/CVE-2024-3806.md) `CVE-2024-3806` · CVE record: P-THEMES Porto · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2024 · Tags: File inclusion - [XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2024-4441.md) `CVE-2024-4441` · CVE record: ravanh XML Sitemap & Google News · CVSS 8.1 High · Not analysed yet · Published 9 May 2024 · Tags: File inclusion - [Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta](https://agentprime.io/advisories/CVE-2024-3807.md) `CVE-2024-3807` · CVE record: P-THEMES Porto · CVSS 8.8 High · Not analysed yet · Published 9 May 2024 · Tags: File inclusion - [CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php.](https://agentprime.io/advisories/CVE-2024-34314.md) `CVE-2024-34314` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 May 2024 · Tags: File inclusion - [Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-3849.md) `CVE-2024-3849` · CVE record: holithemes Click to Chat – HoliThemes · CVSS 8.8 High · Not analysed yet · Published 2 May 2024 · Tags: File inclusion - [ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets](https://agentprime.io/advisories/CVE-2024-3500.md) `CVE-2024-3500` · CVE record: wpmet ElementsKit Pro · CVSS 8.8 High · Not analysed yet · Published 2 May 2024 · Tags: File inclusion - [ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module](https://agentprime.io/advisories/CVE-2024-3499.md) `CVE-2024-3499` · CVE record: roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor · CVSS 8.8 High · Not analysed yet · Published 2 May 2024 · Tags: File inclusion - [Local File Inclusion in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1600.md) `CVE-2024-1600` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 10 Apr 2024 · Tags: File inclusion - [MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template](https://agentprime.io/advisories/CVE-2024-3136.md) `CVE-2024-3136` · CVE record: stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2024 · Tags: File inclusion - [Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/products_photo.php.](https://agentprime.io/advisories/CVE-2024-30849.md) `CVE-2024-30849` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Apr 2024 · Tags: File inclusion - [ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw](https://agentprime.io/advisories/CVE-2024-2047.md) `CVE-2024-2047` · CVE record: roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor · CVSS 8.8 High · Not analysed yet · Published 30 Mar 2024 · Tags: File inclusion Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .