SAXON 5.4 with display_errors enabled allows remote attackers to obtain sensitive information via (1) a direct request for news.php (2) an invalid use of a newsid array parameter to admin/edit-item.php and possibly unspecified vectors related to additional scripts in (3) admin/ (4) rss/ and (5) the root directory of the installation which reveal the path in various error messages.