EIP-2026-111366

This exploit demonstrates multiple local file inclusion (LFI) vulnerabilities in Plume CMS 1.2.4. The vulnerabilities arise from improper handling of user-supplied input in the `_PX_config[manager_path]` and `p` parameters, allowing attackers to include arbitrary files.