CVE-2021-28377

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files...

CVE-2021-28377

CVE-2021-28377 : ChronoForums 2.0.11 is vulnerable to local file inclusion via path traversal in the avatar function, enabling an attacker to read arbitrary files (e.g., configuration files containing credentials). Affected product: ChronoForums/Joomla extension. Root cause: unauthenticated path ...