Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the first parameter.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hot_editor | Ecardmax.com | 4.0 (including) | 4.0 (including) |
| Mybb_hot_editor_plugin | Mybb | * | * |