CVE-2020-11819

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt