Local File Inclusion

larvitbase-www is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...

Design/Logic Flaw

TYPO3 3.7.1 allows remote attackers to obtain sensitive information via a direct request to 1 thumbs.php, 2 showpic.php, or 3 tables.php, which causes them to incorrectly define a variable and reveal the path in an error message when a require function call fails...