CVE-2016-20064
MEDIUM6.2CVSS v3
—CVSS v2
0.02%
EPSS (exploit probability)
CWE-98CWE
Description
WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.
CVSS v3 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected routers (0)
No routers currently mapped to this CVE in our database.