CVE-2023-1427 Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal

2023-04-1712:17:41

WPScan

www.cve.org

photo gallery

10web

cve-2023-1427

path traversal

wordpress

plugin

file upload

0.001 Low

EPSS

Percentile

23.6%

JSON

The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Photo Gallery by 10Web",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.8.15"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/c8917ba2-4cb3-4b09-8a49-b7c612254946

0.001 Low

EPSS

Percentile

23.6%

JSON

Related for CVELIST:CVE-2023-1427