TI-2018-15409 CVE-2018-25184 · GHSA-7p22-frc8-w9h8Surreal ToDo 0.6.1.2 Local File Inclusion via index.phpPriority MEDIUM 64Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content parameter.CVSS 4.0MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.0092 · Published 2026-03-06 · No fix listed CWE-22