EIP-2026-113229

The exploit demonstrates a remote file inclusion vulnerability in Web//News 1.4 and prior versions. By manipulating the WN_BASEDIR parameter in parser.php, an attacker can include and execute arbitrary remote PHP code, leading to remote code execution (RCE).