CVE-2008-5936: Exposure of Sensitive Information to an Unauthorized Actor

front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter...