The vulnerability CVE-2025-28944 affects the snstheme Avaz PHP program through improper control of filenames in include/require statements, enabling PHP Local File Inclusion. This flaw exists in versions up to and including 2.8. The CVSS 3.1 score of 8.1 indicates a high-severity remote vulnerability with no privileges required and no user interaction, but with high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation of this vulnerability allows an attacker to include local files on the affected server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Avoid exposing the affected application to untrusted networks if possible.