What is the CVSS score of CVE-2025-28944?

CVE-2025-28944 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-28944?

A PHP Local File Inclusion vulnerability in snstheme Avaz (versions through 2.8) allows attackers to read sensitive files from affected systems.

How to fix or mitigate CVE-2025-28944?

Within 24 hours: Identify all systems running snstheme Avaz and isolate or disable them from production if possible; notify affected stakeholders. Within 7 days: Implement WAF rules to block malicious file inclusion patterns and monitor for exploitation attempts; apply network segmentation to limit access to vulnerable systems. Within 30 days: Upgrade to Avaz 2.9 or later when available, or migrate to an alternative theme; conduct log analysis to detect any historical exploitation.

PHP CVE-2025-28944

EUVD-2025-17485 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17485

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz allows PHP Local File Inclusion. This issue affects Avaz: from n/a through 2.8.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in the snstheme Avaz plugin that allows unauthenticated remote attackers to include arbitrary PHP files via improper control of filename parameters in include/require statements. The vulnerability affects Avaz versions through 2.8 and has a CVSS score of 8.1 (high severity), enabling attackers to execute arbitrary code, read sensitive files, and compromise system integrity without requiring authentication or user interaction.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical PHP-specific weakness where user-supplied input is passed directly to PHP include() or require() functions without proper validation or sanitization. In the snstheme Avaz plugin, the root cause involves insufficient input filtering on filename parameters, allowing attackers to traverse the filesystem or potentially include remote files (RFI-like behavior despite being classified as LFI). The affected product is snstheme's Avaz theme/plugin for PHP-based web applications, likely WordPress-based given the 'snstheme' vendor designation. The improper filename control permits path traversal sequences (e.g., '../../../') or null byte injection (in older PHP versions) to break out of intended directories and access arbitrary files on the server.