CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...

EUVD-2017-19024

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...

CVE-2017-20287

The Javo Spot theme for WordPress (versions before 3.0.0 ) is vulnerable to a path traversal flaw. This vulnerability exists in the jvfrm_spot_get_json AJAX action, where an unauthenticated attacker can use the fn parameter to read arbitrary files. Specifically, by sending a GET request to /wp-ad...

VulnCheck KEV: CVE-2017-20287

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...

WordPress Javo Spot Premium Theme - Local File Inclusion Detection

WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that allows remote unauthenticated attackers access to locally stored file and return their content. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that...

WordPress Javo Spot Premium Theme - Unauthenticated Directory Traversal Detection

WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion. This file is remotely accessible and its content available for reading. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion.""" from...

Javo Spot Premium Theme - Unauthenticated Directory Traversal

Print out any file in the via an unauthenticated AJAX request. /wp-admin/admin-ajax.php? jvfrmspotgetjson&fn=../../wp-config.php&callback=jQuery...

Javo Spot Premium Theme - Unauthenticated Directory Traversal

Print out any file in the via an unauthenticated AJAX request. PoC /wp-admin/admin-ajax.php? jvfrmspotgetjson=../../wp-config.php=jQuery...

WordPress Javo Spot Premium Theme <= 2.0.0 - Unauthenticated Directory Traversal

WordPress Javo Spot Premium Theme = 2.0.0 - Unauthenticated Directory Traversal / Local File Inclusion vulnerability discovered by Soulseekah Solution Update theme to the latest version at least version 2.0.1...