LFI Local File Inclusion
A vulnerability where a web application lets user input decide which file to load. The classic is ?page=../../../../etc/passwd — but reading files isn't the dangerous part.
The dangerous part is that an included file is executed. In PHP, include($_GET['page']) means any file that happens to contain code gets run, so LFI can often be escalated to remote code execution. The routes there are well known: poison a log file by sending PHP code in your User-Agent and then include the log, go through /proc/self/environ, or abuse session files and uploaded images. The null-byte trick that bypassed appended extensions was closed in PHP 5.3.4. The defence is never passing user input to file functions — use an allowlist of permitted names and look up the actual path from it.