CVE-2025-64377 describes a Local File Inclusion vulnerability in CridioStudio's ListingPro software due to improper control of filenames in PHP include/require statements. This allows an attacker to manipulate file inclusion, potentially executing arbitrary code or accessing sensitive files. The vulnerability affects ListingPro versions before 2.9.10. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild. The vulnerability is not related to a cloud service, so remediation requires applying vendor patches when available.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service availability. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor CridioStudio's advisories for updates and apply any released patches promptly. Until a fix is available, restricting access to vulnerable endpoints and employing web application firewalls to detect suspicious file inclusion attempts may help reduce risk.