Vulnerabilities > Videowhisper > Videowhisper Live Streaming Integration > 4.25
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-12-29 | CVE-2014-1908 | Information Exposure vulnerability in Videowhisper Live Streaming Integration The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. | 5.0 |
| 2014-12-29 | CVE-2014-1905 | Command Injection vulnerability in Videowhisper Live Streaming Integration Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename. | 10.0 |
| 2014-07-01 | CVE-2014-4569 | Cross-Site Scripting vulnerability in Videowhisper Live Streaming Integration Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the room_name parameter. | 4.3 |