• WordPress Plugin DM Albums is prone to a remote file inclusion vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin DM Albums version 1.9.2 is vulnerable; prior versions may also be affected.

• Update to the latest version

• • http://www.securityfocus.com/bid/35521/exploit
  • http://www.exploit-db.com/exploits/9043/
  • http://packetstormsecurity.com/files/view/78744/dmalbums-rfi.txt
  • http://secunia.com/advisories/35619/

• 

• CVE-2009-2396

• CWE-94

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Missing Update File Inclusion

• Drupal Core 4.7.x Cross-Site Request Forgery (4.7.0 - 4.7.3)
• Drupal Core 8.5.x Multiple Vulnerabilities (8.5.0 - 8.5.7)
• WordPress Plugin Acurax On Click Pop Under Multiple Unspecified Vulnerabilities (2.2.1)
• WordPress Plugin WP Symposium Arbitrary File Upload (14.11)
• WordPress Plugin Question Answer Multiple Cross-Site Scripting Vulnerabilities (1.2.30)