Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) layerstyle parameter to adlayer.php or (2) language parameter to js-form.php.
| Software | From | Fixed in |
|---|---|---|
| phppgads / phppgads | - | 2.0.5.x |
| phpadsnew / phpadsnew | - | 2.0.5.x |