Description
zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.
Remediation
References
Related Vulnerabilities
phpMyAdmin Other Vulnerability (CVE-2006-3388)
Oracle Database Server CVE-2009-1970 Vulnerability (CVE-2009-1970)
Drupal Improper Access Control Vulnerability (CVE-2016-5385)
WordPress Plugin HDW Player (Video Player & Video Gallery) SQL Injection (2.4.2)
WordPress Plugin Photospace Gallery Cross-Site Scripting (2.3.5)