EIP-2026-109817

The exploit demonstrates multiple remote file inclusion (RFI) vulnerabilities in N/X WCMS 4.5 due to insecure handling of user-supplied input in various PHP scripts. Attackers can inject malicious shell paths via parameters like 'path' and 'c[path]' to achieve remote code execution.