CVE-2025-23949

Name of the Vulnerable Software and Affected Versions Mihajlovic Nenad Improved Sale Badges – Free Version versions 1.0.1 and earlier

Description The issue is related to improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local File Inclusion.

Recommendations For Mihajlovic Nenad Improved Sale Badges – Free Version versions 1.0.1 and earlier, consider disabling the include/require functionality until a patch is available. Restrict access to sensitive files to minimize the risk of exploitation. Avoid using user-supplied input in the include/require statement until the issue is resolved.