Description
zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.
Remediation
References
Related Vulnerabilities
WordPress Plugin Let Them Unsubscribe Multiple Unspecified Vulnerabilities (1.0)
Moodle Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-1754)
Moodle Credentials Management Errors Vulnerability (CVE-2009-4304)
WordPress Plugin Upload File Type Settings Cross-Site Scripting (1.1)