yahoo-inc/cve-impacts huggingface dataset:
CVE-2011-3685: Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials, which allows local users to obtain sensitive information by leveraging read access to (1) authentication.dat or (2) XML files in the Exports directory.
Key phrases: obtain sensitive information, obtain sensitive information by leveraging read access to
CVE-2011-3686: Multiple cross-site scripting (XSS) vulnerabilities in myAddressBook.asp in Sonexis ConferenceManager 9.2.11.0 and 9.3.14.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, (3) email_edit, (4) email, (5) email2, (6) email3, (7) sms, (8) sms_id, or (9) work parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2011-3687: Multiple cross-site scripting (XSS) vulnerabilities in Sonexis ConferenceManager 9.2.11.0 allow remote attackers to inject arbitrary web script or HTML via (1) the txtConferenceID parameter to HostLogin.asp, (2) the txtConferenceID parameter to ParticipantLogin.asp, (3) the acp parameter to ForgotPIN.asp, or the (4) Description, (5) title, or (6) Heading parameter to Error.asp.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross-site scripting (xss)
CVE-2011-3688: Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via (1), sql injection, arbitrary sql commands
CVE-2011-3689: Cross-site scripting (XSS) vulnerability in Licenses.html in Wibu-Systems CodeMeter WebAdmin 3.30 and 4.30 allows remote attackers to inject arbitrary web script or HTML via the BoxSerial parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2011-3690: Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.
Key phrases: gain privileges, gain privileges via a Trojan horse mfc70enu.dll or, untrusted search path
CVE-2011-3691: Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
Key phrases: gain privileges, gain privileges via a Trojan horse dwmapi.dll, untrusted search path
CVE-2011-3692: NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.
Key phrases: obtain sensitive information, obtain sensitive information by reading this file and, cleartext console credentials
CVE-2011-3693: NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.
Key phrases: discover cleartext server credentials by reading the NetSaro.fdb
CVE-2011-3694: The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.
Key phrases: read application source code by appending a %
CVE-2011-3695: 111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3696: 60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3697: Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3698: AdaptCMS 2.0.2 Beta allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/poll_vote.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3699: John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3700: Advanced Electron Forum (AEF) 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopic_lang.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3701: AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, common.php
CVE-2011-3702: Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/template.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3703: AneCMS 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/menu/index.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3704: appRain 0.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by cron.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3705: Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3706: ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3707: JanRain PHP OpenID library (aka php-openid) 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3708: Automne 4.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/page-redirect-info.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3709: b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ru_RU/ru-RU.locale.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3710: bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by bb-templates/kakumei/view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3711: BIGACE 2.7.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/libs/javascript.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3712: CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3713: cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/session_check.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, cftp
CVE-2011-3714: ClanSphere 2010.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by mods/board/attachment.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3715: ClanTiger 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/statistics.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3716: Claroline 1.9.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by work/connector/linker.cnr.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3717: ClipBucket 2.0.9 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/signup_captcha/signup_captcha.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3718: CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files.  NOTE: this might overlap CVE-2007-5444.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3719: CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3720: conceptcms 5.3.1, 5.3.3, and possibly other versions allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by sys_libs/umlib/um_authserver.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3721: concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/spellchecker_service.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3722: Coppermine Photo Gallery (CPG) 1.5.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/inspekt.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3723: Crafty Syntax 3.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by README_FILES/livehelp.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3724: CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/shipping/USPS/calc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3725: DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by header_html.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3726: DoceboLMS 4.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by views/dummy/show.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3727: DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3728: Dolphin 7.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/BxDolXMLRPCProfileView.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3729: dotproject 2.1.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by style/dp-grey-theme/footer.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3730: Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3731: e107 0.7.24 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by e107_plugins/pdf/e107pdf.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3732: eggBlog 4.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by _lib/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3733: Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visual_test.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3734: Energine 2.3.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by core/framework/SimpleBuilder.class.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3735: Escort Agency CMS (aka escort-agency-cms) allows remote attackers to obtain sensitive information via crafted array parameters in a request to a .php file, which reveals the installation path in an error message, as demonstrated by makethumb.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via crafted array parameters in
CVE-2011-3736: ExoPHPDesk 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by upgrades/upgrade9.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3737: eyeOS 2.2.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by apps/rmail/webmail/program/lib/Net/SMTP.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3738: Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3739: Freeway 1.5 Alpha allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/Freeway/boxes/last_product.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3740: FrontAccounting 2.3.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by reporting/includes/fpdi/fpdi2tcpdf_bridge.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3741: Ganglia 3.1.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by host_view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3742: HelpCenter Live 2.1.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/HelpCenter/index.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3743: Hesk 2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/footer.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3744: HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3745: HycusCMS 1.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/hycus_template/template.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3746: Jcow 4.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/page.tpl.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3747: Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by libraries/phpmailer/language/phpmailer.lang-joomla.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3748: Kamads Classifieds 2_B3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by V2A_XHTML/style/view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3749: ka-Map 1.0-20070205 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3750: kPlaylist 1.8.502 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by getid3/getid3/write.id3v1.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3751: LifeType 1.2.10 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/badbehavior/pluginbadbehavior.class.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3752: LimeSurvey 1.90+ build9642-20101214 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/statistics.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3753: LinPHA 1.3.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by viewer.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3754: Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/sef.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3755: MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by view_all_inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3756: MicroBlog 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by init.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3757: Moodle 2.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by webservice/xmlrpc/locallib.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3758: ::mound:: 2.1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/smarty/libs/sysplugins/smarty_internal_template.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3759: MyBB (aka MyBulletinBoard) 1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/3rdparty/diff/Diff/ThreeWay.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3760: Nucleus 3.61 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/api_nucleus.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3761: NuSOAP 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by nuSOAP/classes/class.wsdl.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3762: OpenBlog 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3763: OpenCart 1.4.9.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/startup.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3764: OpenDocMan 1.2.6-svn-2011-01-21 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by User_Perms_class.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3765: Open-Realty 2.5.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/versions/upgrade_115.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3766: OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3767: osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, redirect.php
CVE-2011-3768: Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3769: PHPads 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ads.inc.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3770: phpAlbum 0.4.1.14 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Flowing_Dark/parameters.tpl.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3771: phpBook 2.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by doc/update_smilies_1.50-1.60.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3772: phpCollab 2.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by topics/noti_newtopic.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3773: PHPDevShell 3.0.0-Beta-4b allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by gzip.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3774: php Easy Survey Package (phpESP) 2.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/landing.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3775: PHPfileNavigator 2.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xestion/varios/logs.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3776: phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3777: phpFreeChat 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/zilveer/style.css.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3778: PhpGedView 4.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by serviceClientTest.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3779: PhpHostBot 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/create_acct.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3780: PHP iCalendar 2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by rss/rss_common.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3781: PHPIDS 0.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/IDS/VersionTest.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3782: phpLD 2-151.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by libs/smarty/Smarty_Compiler.class.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3783: phpMyFAQ 2.6.13 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lang/language_uk.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3784: Francisco Burzi PHP-Nuke 8.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Odyssey/theme.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3785: PHP Point Of Sale (POS) 10.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3786: PHProjekt 6.0.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Setup/Controllers/IndexController.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3787: phpScheduleIt 1.2.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/schedule.template.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3788: PhpSecInfo 0.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Test/Test_Suhosin.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3789: phpwcms 1.4.7 r412 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by template/inc_script/frontend_render/disabled/majonavi.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3790: Piwigo 2.1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/metadata.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3791: Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3792: Pixelpost 1.7.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/functions_feeds.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3793: Pixie 1.04 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/modules/static.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3794: Pligg CMS 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/init.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3795: Podcast Generator 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by core/themes.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3796: PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by product-sort.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3797: ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3798: Rapid Leech 2.3-v42-svn322 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by classes/pear.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to, rapid leech
CVE-2011-3799: ReOS 2.0.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by padmin/blocks/vergal.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3800: Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3801: SimpleTest 1.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test/visual_test.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3802: StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3803: SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3804: SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by _plugin/tiny_mce/plugins/advimage/images.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3805: TaskFreak! multi-mysql-0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/language/zh/register_info.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3806: TCExam 11.1.015 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/code/tce_page_footer.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3807: Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplib_db.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3808: The Bug Genie 2.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/svn_integration/config.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3809: TheHostingTool (THT) 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/pear/Mail/smtp.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3810: TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by i_frames/i_register.php.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3811: TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3812: Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3813: Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/language/dutch.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3814: WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ws/user_mod.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3815: WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3816: WEBinsta mailing list manager 1.3e allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/install3.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3817: Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files.  NOTE: this might overlap CVE-2005-2436.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3818: WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3819: WoW Server Status 4.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by status.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3820: WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3821: xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajax_core/plugin_layer/xajaxScriptPlugin.inc.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3822: XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/system/xoops_version.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to
CVE-2011-3823: Yamamah 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/index.php and certain other files.
Key phrases: obtain sensitive information, obtain sensitive information via a direct request to