CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
Explanation of Vulnerability in Simple Terms
Blueprint versions before 1.1.5 contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service availability. The attack requires network access and significant technical effort to exploit, but no authentication or user interaction. Organizations using Blueprint should update immediately to version 1.1.5 or later.
What an attacker can do
Read sensitive data, modify site content, or cause service disruption without authentication.
Potential impact on your site
Confidential data exposure, unauthorized content changes, or site downtime if Blueprint is not updated.
Conditions required to exploit
Network access and high technical complexity to craft the exploit; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
