Description
Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files.
Remediation
References
Related Vulnerabilities
Drupal Core 8.x.x Denial of Service (8.0.0 - 8.6.18)
IBMHttpServer Other Vulnerability (CVE-2006-3918)
WordPress Plugin Thrive Leads Security Bypass (2.3.9.3)
WordPress Plugin Google Analytics by BestWebSoft Cross-Site Scripting (1.7.0)
Jenkins Improper Authentication Vulnerability (CVE-2018-1999045)