WordPress Photocrati NextGEN Gallery Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Photocrati NextGEN Gallery plugin is one of the image management plugin. A cross-site scripting vulnerability exist...

WordPress NextGEN Gallery Plugin < 2.1.15 Malicious File Upload Vulnerability

The WordPress plugin Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2015-9229

In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images1alttext parameter...

Information disclosure

In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images1alttext parameter...

CVE-2015-9229

CVE-2015-9229 affects the WordPress Photocrati NextGEN Gallery plugin (version 2.1.15) in the nggallery-manage-gallery page. The vulnerability is a cross-site scripting (XSS) issue exploitable by remote authenticated administrators via the images[1][alttext] parameter, as described in the CVE det...

CVE-2015-9229

In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images1alttext parameter...

CVE-2015-9228

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

Unrestricted file upload

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

CVE-2015-9228

CVE-2015-9228 affects WordPress Photocrati NextGEN Gallery plugin, version 2.1.10. The vulnerability allows unrestricted file upload via the name parameter when a file extension is changed from .jpg to .php, enabling potentially arbitrary PHP uploads. The NVD entry notes high-impact risk (Confide...

CVE-2015-9228

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

echoesofsinatra.com XSS vulnerability

Vulnerable URL: http://echoesofsinatra.com/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=9=540=540=1=1=1=1=5000=fade=1=Slides=== http://edjesales.com/catalogpage.php?catalogid=613 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017...

NextGEN Gallery geo <= 1.0 - Unauthenticated PHP Object Injection

The plugin nextgen-gallery-geo insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. The original researcher notified the WordPress Plugins team. PoC Attack is exploitable over AJAX calls sites with...

NextGEN Gallery geo <= 1.0 - Unauthenticated PHP Object Injection

The plugin nextgen-gallery-geo insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. The original researcher notified the WordPress Plugins team. Attack is exploitable over AJAX calls sites with the...

WordPress NextGEN Gallery suffers from a SQL Injection Vulnerability

NextGEN Gallery is a WordPress gallery plugin. A SQL injection vulnerability exists in NextGEN Gallery 2.1.77 and earlier versions, which can be exploited by attackers to obtain sensitive database information...

WordPress plugin vulnerabilities affect over 100 million websites-vulnerability warning-the black bar safety net

As our Sucuri firewallWAF, vulnerability research part of the project, in order to find the existence of security issues, we have audited the plurality of open source projects. When audit WordPress“NextGEN”Gallery plugin, we found a seriousSQL injectionvulnerabilities. The vulnerability allows an...

Million-Plus WordPress Sites Exposed by Vulnerable Plugin

A popular WordPress gallery plugin with more than one million active installations was recently patched to address a vulnerability exposing website databases to attack. The NextGEN Gallery is a photo gallery management system used by professional photographers and artists upload, sort and group...

WordPress plugin NextGEN Gallery SQL injection vulnerability

As part of a vulnerability research project for our Sucuri Firewall WAF, we have been auditing multiple open source projects looking for security issues. While working on the WordPress plugin NextGEN Gallery, we discovered a severe SQL Injection vulnerability. This vulnerability allows an...

WordPress Plugin NextGEN Gallery SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin NextGEN Gallery. It allows unauthenticated users to obtain...

NextGEN Gallery < 2.1.79 - Unauthenticated SQL Injection

According to the original source, one of the following conditions must be met for exploitation: 1. The use of a NextGEN Basic TagCloud gallery. 2. If users are able to submit posts to be reviewed contributors...

WordPress NextGEN Gallery plugin <= 2.1.59 - Authenticated Remote Code Execution (RCE) Vulnerability

WordPress NextGEN Gallery plugin v2.1.59 is prone to authenticated remote code execution RCE vulnerability. It allows an attacker to change the file name stylesettingsCSSfile value on the /wp-admin/admin.php?page=nggotheroptions page. If an attacker change the file extension to PHP, he can execut...