CVE-2014-1907

MEDIUM 6.4 CVSS 2.0

Published: March 6, 2014
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-22
CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

Description

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.

Affected products and versions

n/a n/a — Versions not specified

References

packetstormsecurity.com http://packetstormsecurity.com/files/125454 Exploit
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/91478
www.htbridge.com https://www.htbridge.com/advisory/HTB23199 Exploit
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References