Description

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.

Remediation

References

CVE-2016-10038

Related Vulnerabilities

Nexus Insertion of Sensitive Information Into Sent Data Vulnerability (CVE-2026-77123)

WordPress Plugin Pondol Carousel Cross-Site Scripting (1.0)

WordPress Plugin wpCentral Security Bypass (1.4.7)

WordPress Plugin WP Sitemap Page Cross-Site Scripting (1.6.4)

Serendipity Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2024-58282)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities CWE-22 CVE-2016-10038