WS-2022-0391

The GLPI's plugin named glpi-archimapcontains an ajax route named getconfig.php which allows a user to retrieve the plugin configuration. However, this route is accessible by everyone because there is no authentication check. Moreover, the attacker can inject his own SQL queries and get directly...

CVE-2008-5752

Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the bookid parameter. NOTE: some of these details are obtained from third...

Directory traversal

Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the bookid parameter. NOTE: some of these details are obtained from third...

CVE-2008-5752

CVE-2008-5752 affects the WordPress Page Flip Image Gallery plugin (versions up to 0.2.2). The vulnerability is a directory traversal in getConfig.php that, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a ".." payload in the book_id parameter. Root cause i...

CVE-2008-5752: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the bookid parameter. NOTE: some of these details are obtained from third...