EIP-2026-107802

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in iManager Plugin v1.2.8. The 'lang' parameter in multiple scripts is not properly sanitized, allowing directory traversal attacks and URL-encoded NULL bytes to include arbitrary local files.