What is the CVSS score of EUVD-2025-17484?

EUVD-2025-17484 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-17484?

A high-severity file inclusion vulnerability in GiftXtore versions up to 1.7.4 could allow attackers to access sensitive files or execute malicious code on affected systems.

How to fix or mitigate EUVD-2025-17484?

Within 24 hours: Identify all systems running GiftXtore 1.7.4 and earlier; isolate affected instances from production if possible. Within 7 days: Implement WAF rules to block malicious file inclusion patterns; apply input validation and output encoding at the application layer; review access logs for exploitation attempts. Within 30 days: Contact vendor for patch timeline; evaluate alternative solutions or upgrade path; conduct security assessment of affected systems for indicators of compromise.

PHP EUVD-2025-17484

| CVE-2025-28888 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17484

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore allows PHP Local File Inclusion. This issue affects GiftXtore: from n/a through 1.7.4.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in BZOTheme GiftXtore versions through 1.7.4 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. This is a high-severity vulnerability (CVSS 8.1) that can lead to complete system compromise including confidentiality, integrity, and availability breaches. The vulnerability stems from improper validation of filename parameters in PHP include/require statements, enabling attackers to access sensitive files or execute malicious code without authentication.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic server-side code injection flaw. The affected product BZOTheme GiftXtore (CPE likely: cpe:2.3:a:bzotheme:giftxtore:*:*:*:*:*:*:*:*) improperly handles user-supplied input when constructing file paths for PHP include() or require() functions. Rather than Remote File Inclusion (RFI), this specific instance is Local File Inclusion (LFI), meaning attackers can only access files already present on the server filesystem. However, LFI can be escalated to RCE through log file poisoning, session file manipulation, or by including PHP wrappers (data://, php://filter) depending on PHP configuration. The vulnerability likely exists in a template engine, theme loader, or module inclusion mechanism within the GiftXtore e-commerce platform.