CVE-2012-6652

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ceriksen.com/2012/07/10/wordpress-a-page-flip-book-plugin-local-file-inclusion-vulnerability/Exploit, Third Party Advisory
https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/Third Party Advisory
https://www.openwall.com/lists/oss-security/2014/07/30/2Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2014/07/31/8Mailing List, Third Party Advisory
http://ceriksen.com/2012/07/10/wordpress-a-page-flip-book-plugin-local-file-inclusion-vulnerability/Exploit, Third Party Advisory
https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/Third Party Advisory
https://www.openwall.com/lists/oss-security/2014/07/30/2Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2014/07/31/8Mailing List, Third Party Advisory

Timeline

Published: May 13, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-66537.5Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack v CVE-2012-66547.5Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) res CVE-2012-66553.3An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain en CVE-2012-66565.0iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds r CVE-2012-66574.9The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with CVE-2012-66584.3Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML vi CVE-2012-66594.3Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web scri CVE-2012-666010.0GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator user, and (3) PlatinumO CVE-2012-66615.0Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which m CVE-2012-66624.3Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1 CVE-2012-66637.5General Electric D20ME devices are not properly configured and reveal plaintext passwords.CVE-2012-66649.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read