CVE-2016-1212

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.

Metrics

CVSS 3.0 2.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN42545812/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000069Vendor Advisory
http://www.futomi.com/library/info/2016/201605.htmlVendor Advisory
http://jvn.jp/en/jp/JVN42545812/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000069Vendor Advisory
http://www.futomi.com/library/info/2016/201605.htmlVendor Advisory

Timeline

Published: Jun 5, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-12136.1The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.CVE-2016-12146.1Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.CVE-2016-12156.1Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.CVE-2016-12166.1Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.CVE-2016-12176.1Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.CVE-2016-12188.8SQL injection vulnerability in Cybozu Garoon before 4.2.2.CVE-2016-12199.8Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.CVE-2016-12204.3Cybozu Garoon before 4.2.2 does not properly restrict access.CVE-2016-12215.9Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv CVE-2016-12226.1Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web s CVE-2016-12235.3Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Securit CVE-2016-12246.1CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote atta