SourceCodester Leave Application System 1.0 contains a file inclusion vulnerability triggered by manipulation of the 'page' argument. This flaw allows remote attackers to include arbitrary files, potentially leading to information disclosure or code execution depending on the included content. The vulnerability is remotely exploitable without privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include files on the server, which may lead to information disclosure or further compromise depending on the server environment and included files. The impact is rated medium due to the potential for remote exploitation without authentication, but with limited impact on confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable parameter, implementing input validation or web application firewall rules to block malicious input targeting the 'page' argument. Monitor vendor channels for updates and patches.