Description
zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2007-5531 Vulnerability (CVE-2007-5531)
WordPress Plugin Amazon Product in a Post SQL Injection (3.5.2)
WordPress Plugin Donorbox-Free Recurring Donation Form Cross-Site Scripting (7.1.1)
PHP NULL Pointer Dereference Vulnerability (CVE-2016-7130)
WordPress Plugin Inline Gallery 'do' Parameter Cross-Site Scripting (0.3.9)