A Local File Inclusion vulnerability exists in SourceCodester Leave Application System 1.0. By manipulating the "page" argument, an attacker can force the application to include arbitrary files, potentially leading to execution of malicious code on the server. The description explicitly notes that remote exploitation is possible and the exploit is publicly available, indicating that an unauthenticated attacker can trigger the vulnerability from outside the application.

The only documented affected product is SourceCodester Leave Application System version 1.0. No other versions or additional products are identified.

The CVSS score of 6.9 reflects moderate to high severity. Although an EPSS score is not available and the vulnerability is not listed in the KEV catalog, the public availability of the exploit and the potential for remote code execution make it a high priority risk. Based on the description, the likely attack vector is an unauthenticated HTTP request manipulating a GET or POST parameter; the exploitation requires the application to resolve the file path on the server, implying the vulnerability could be triggered by remote hosts.