CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.9.5.
Explanation of Vulnerability in Simple Terms
Event Post versions up to 5.9.5 contain an information disclosure vulnerability. An attacker on the network can read sensitive data without authentication or user interaction. The vulnerability stems from improper access controls that fail to restrict data visibility. Site administrators should update to a version newer than 5.9.5.
What an attacker can do
Read sensitive data from the site without logging in.
Potential impact on your site
Confidential information may be exposed to unauthenticated visitors.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
