CVE-2015-5065

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75416Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerceThird Party Advisory
https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/Patch, Third Party Advisory
https://www.exploit-db.com/exploits/37253/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75416Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerceThird Party Advisory
https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/Patch, Third Party Advisory
https://www.exploit-db.com/exploits/37253/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jun 24, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-50664.3Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script o CVE-2015-50677.5The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obt CVE-2015-50687.5XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unsp CVE-2015-50694.3The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth CVE-2015-50703.1The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth CVE-2015-50716.5AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "CVE-2015-50726.5The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users CVE-2015-50739.1Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial CVE-2015-50747.5Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM be CVE-2015-50756.8Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of adminis CVE-2015-50764.3Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or CVE-2015-50786.5SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenti