PHP functions are subject to both remote file inclusion and
directory traversal, and it might be that only the file inclusion is
publicly reported. (In fact, the overlap is so close that this
sometimes causes difficulties with classification).