emlog 5.3.1 Path Disclosure

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. id: CVE-2021-3293 info: name: emlog 5.3.1 Path Disclosure author: h1ei1 severity: medium description: emlog v5.3.1 is susceptible to full path disclosure via...

WP Popups - Information Disclosure

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. id: CVE-2024-6555 info: name: WP Popups - Informatio...

Campaign Monitor for WordPress - Information Disclosure

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

DedeCMS 5.7 - Path Disclosure

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php id: CVE-2018-6910 info: name: DedeCMS 5.7 - Path Disclosure author: pikpikcu severity: high description: DedeCMS 5.7 allows remote attackers to discover t...

CVE-2024-45440

CVE-2024-45440 Drupal CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. Usage python CVE-2024-45440.py Lab Deployment settings.php will replace the settings.ph...

CVE-2024-45440

Enumeration tool for CVE-2024-45440 by DividesByZer0 & c0d3Ninja CVE-2024-45440 - Drupal 11.x-dev Full Path Disclosure PoC options: -h, --help show this help message and exit -u URL, --url URL Single URL to scan. -f FILE, --file FILE File containing URLs to scan one per line. -t THREADS, --thread...

CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - Advisory 06 - 25/02/05 Program: phpBB 2.0.12 Homepage: http://www.phpbb.com Vulnerable Versions: phpBB 2.0.12 & Lower versions Risk: Low Risk!! Impact: Full path disclosure -==phpBB 2.0.12 Full path disclosure==- Description phpB...

CVE-2024-5735

CVE-2024-5735 AdmirorFrames Joomla! Extension params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR; This issue was caused by direct usage of JPATHBASE variable when constructing image path. This problem has...

CVE-2025-6082

CVE-2025-6082 Full Path Disclosure PoC Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 Vulnerability : Full Path Disclosure CWE-200 Description This Proof‑of‑Concept exploits a Full Path Disclosure bug in the Birth Chart Compatibility WordPress plugin versions ≤ 2.0. The POC send...

AWStats <= 7.5 - Full Path Disclosure

AWStats 7.6 contains a full path disclosure caused by improper handling of framename and update parameters in awstats.pl, letting remote attackers determine server file paths, exploit requires sending crafted parameters. id: CVE-2018-10245 info: name: AWStats = 7.5 - Full Path Disclosure author:...

Eval Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Eval Injection via unsanitized input in the fromfullpath and createline functions. An attacker can execute arbitrary code at import time by supplying malicious schema extensions tha...

WordPress The Events Calendar - Full Path Disclosure Detection

WordPress The Events Calendar plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress The Events Calendar plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Astra Sites - Full Path Disclosure Detection

WordPress Starter Templates plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Starter Templates plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Advanced iFrame - Full Path Disclosure Detection

WordPress Advanced iFrame plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced iFrame plugin files are publicly accessible...

WordPress OceanWP - Full Path Disclosure Detection

WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files.""" from kittysploit import from lib.protocols.http.httpclien...

WordPress Plugin iThemes Security - Full Path Disclosure Detection

WordPress Plugin iThemes Security files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin iThemes Security files are publicly accessible...

WordPress Breadcrumb NavXT - Full Path Disclosure Detection

The Breadcrumb NavXT plugin for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Breadcrum...

WordPress Data Source for Contact Form 7 - Full Path Disclosure Detection

WordPress Plugin CData Source for Contact Form 7 files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CData Source for Contact Form 7...

WordPress Plugin GDPR Cookie Consent - Full Path Disclosure Detection

WordPress GDPR Cookie Consent cookie-law-info plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress GDPR Cookie Consent cookie-law-info plugin is vulnerable to full path disclosure via direct access.""" from...