This vulnerability arises from improper validation or control of filenames passed to PHP include or require statements in the Real Estate Manager application by Rameez Iqbal. The flaw enables a local file inclusion attack, where an attacker with limited privileges can cause the application to include unintended local files, potentially executing malicious code or exposing sensitive information. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and low privileges required.

Successful exploitation can lead to local file inclusion, allowing attackers to execute arbitrary code or disclose sensitive information on the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and limit user privileges to reduce risk. Avoid exposing the application to untrusted networks where possible.