Code injection

2018-07-1320:29:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

51.8%

JSON

The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).

CPENameOperatorVersion
nextgen_gallerylt2.1.57

CPE	Name	Operator	Version
	nextgen_gallery	lt	2.1.57

References

www.kb.cert.org/vuls/id/346175

www.securityfocus.com/bid/94356/