| Package | Affected versions | Patched versions |
|---|---|---|
| fd script | = 1.3= 1.3.1= 1.3.2 |
download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free