CVE-2010-0696

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 28%

from disclosure to weapon0 days

Published on NVDFeb 23

1st PoCFeb 14

exploitation probability

28%top 2% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/11447unverified cve_referencewww.exploit-db.com/exploits/11447unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/62331 http://secunia.com/advisories/38587 http://www.exploit-db.com/exploits/11447 http://www.joomlaworks.gr/content/view/77/34/http://www.securityfocus.com/bid/38238