Description

WordPress Plugin Vitamin is prone to multiple arbitrary file disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view local files in the context of the web server process, which may aid in launching further attacks. WordPress Plugin Vitamin version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.1.0 or latest

References

http://secunia.com/advisories/50176/

http://www.securityfocus.com/bid/54856/

Related Vulnerabilities

WordPress Plugin WP Advanced Comment Cross-Site Scripting (0.10)

PrestaShop Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-39526)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3828)

PHP Other Vulnerability (CVE-2015-0232)

Oracle Database Server Other Vulnerability (CVE-2002-1767)

Severity

High

Classification

CVE-2012-6651 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure