The vulnerability CVE-2025-28998 affects SERPed.net versions up to 4.6 and involves improper control of filenames used in PHP include or require statements. This weakness leads to PHP Local File Inclusion, which can allow an attacker to execute arbitrary local files on the affected system. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can result in the attacker reading or executing arbitrary local files on the server running SERPed.net, potentially leading to full compromise of the application and underlying system. The high CVSS score indicates severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected application and applying any available workarounds recommended by the vendor.