CVE-2012-1205

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/79250
http://plugins.trac.wordpress.org/changeset/504380/relocate-uploadExploit, Patch
http://secunia.com/advisories/47976Vendor Advisory
http://wordpress.org/extend/plugins/relocate-upload/changelog/Patch
http://www.securityfocus.com/bid/49693Exploit
http://osvdb.org/79250
http://plugins.trac.wordpress.org/changeset/504380/relocate-uploadExploit, Patch
http://secunia.com/advisories/47976Vendor Advisory
http://wordpress.org/extend/plugins/relocate-upload/changelog/Patch
http://www.securityfocus.com/bid/49693Exploit

Timeline

Published: Feb 24, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-12069.3Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (CVE-2012-12075.0Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows r CVE-2012-12084.3Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2 CVE-2012-12094.3Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows r CVE-2012-12107.5SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id param CVE-2012-12114.3Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script o CVE-2012-12124.3Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic CVE-2012-12134.3Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and CVE-2012-12144.3Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inj CVE-2012-12154.3Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers t CVE-2012-12166.8Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication CVE-2012-12174.3Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML