blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-9228

HIGH 8.8 CVSS 3.0
Published
September 12, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-434
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

Affected WordPress components

  • Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Plugin · nextgen-gallery
    Confirmed match Active
    Versions not specified
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • imagely nextgen_gallery — Version 1.5.0
  • imagely nextgen_gallery — Version 1.5.1
  • imagely nextgen_gallery — Version 1.5.2
  • imagely nextgen_gallery — Version 1.5.3
  • imagely nextgen_gallery — Version 1.5.4
  • imagely nextgen_gallery — Version 1.5.5
  • imagely nextgen_gallery — Version 1.6.0
  • imagely nextgen_gallery — Version 1.6.1
  • imagely nextgen_gallery — Version 1.6.2
  • imagely nextgen_gallery — Version 1.7.0
  • imagely nextgen_gallery — Version 1.7.1
  • imagely nextgen_gallery — Version 1.7.2
  • imagely nextgen_gallery — Version 1.7.3
  • imagely nextgen_gallery — Version 1.7.4
  • imagely nextgen_gallery — Version 1.8.0
  • imagely nextgen_gallery — Version 1.8.1
  • imagely nextgen_gallery — Version 1.8.2
  • imagely nextgen_gallery — Version 1.8.3
  • imagely nextgen_gallery — Version 1.8.4
  • imagely nextgen_gallery — Version 1.9.0
  • imagely nextgen_gallery — Version 1.9.1
  • imagely nextgen_gallery — Version 1.9.2
  • imagely nextgen_gallery — Version 1.9.3
  • imagely nextgen_gallery — Version 1.9.5
  • imagely nextgen_gallery — Version 1.9.6
  • imagely nextgen_gallery — Version 1.9.7
  • imagely nextgen_gallery — Version 1.9.8
  • imagely nextgen_gallery — Version 1.9.10
  • imagely nextgen_gallery — Version 1.9.11
  • imagely nextgen_gallery — Version 1.9.12
  • imagely nextgen_gallery — Version 1.9.13
  • imagely nextgen_gallery — Version 2.0
  • imagely nextgen_gallery — Version 2.0.7
  • imagely nextgen_gallery — Version 2.0.11
  • imagely nextgen_gallery — Version 2.0.14
  • imagely nextgen_gallery — Version 2.0.17
  • imagely nextgen_gallery — Version 2.0.21
  • imagely nextgen_gallery — Version 2.0.23
  • imagely nextgen_gallery — Version 2.0.25
  • imagely nextgen_gallery — Version 2.0.27
  • imagely nextgen_gallery — Version 2.0.30
  • imagely nextgen_gallery — Version 2.0.31
  • imagely nextgen_gallery — Version 2.0.33
  • imagely nextgen_gallery — Version 2.0.40
  • imagely nextgen_gallery — Version 2.0.57
  • imagely nextgen_gallery — Version 2.0.58
  • imagely nextgen_gallery — Version 2.0.59
  • imagely nextgen_gallery — Version 2.0.61
  • imagely nextgen_gallery — Version 2.0.63
  • imagely nextgen_gallery — Version 2.0.65
  • imagely nextgen_gallery — Version 2.0.66
  • imagely nextgen_gallery — Version 2.0.66.16
  • imagely nextgen_gallery — Version 2.0.66.17
  • imagely nextgen_gallery — Version 2.0.66.26
  • imagely nextgen_gallery — Version 2.0.66.27
  • imagely nextgen_gallery — Version 2.0.66.29
  • imagely nextgen_gallery — Version 2.0.66.31
  • imagely nextgen_gallery — Version 2.0.66.33
  • imagely nextgen_gallery — Version 2.0.71
  • imagely nextgen_gallery — Version 2.0.74
  • imagely nextgen_gallery — Version 2.0.76
  • imagely nextgen_gallery — Version 2.0.77
  • imagely nextgen_gallery — Version 2.0.78
  • imagely nextgen_gallery — Version 2.0.78.1
  • imagely nextgen_gallery — Version 2.0.79
  • imagely nextgen_gallery — Version 2.1.0
  • imagely nextgen_gallery — Version 2.1.2
  • imagely nextgen_gallery — Version 2.1.7
  • imagely nextgen_gallery — Version 2.1.9
  • imagely nextgen_gallery — Version 2.1.10

References

  • www.openwall.com http://www.openwall.com/lists/oss-security/2015/10/27/6 Mailing List, Third Party Advisory
  • cybersecurityworks.com https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.html
  • github.com https://github.com/cybersecurityworks/Disclosed/issues/6 Vendor Advisory
  • packetstormsecurity.com https://packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.html Third Party Advisory, VDB Entry
  • wordpress.org https://wordpress.org/plugins/nextgen-gallery/#developers Vendor Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9758
  • nvd.nist.gov Official NVD record