RSS   Vulnerabilities for 'Nextgen gallery'   RSS

2022-07-07
 
CVE-2015-1784

CWE-434
 
 
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.

 
 
CVE-2015-1785

CWE-352
 
 
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.

 
2021-05-05
 
CVE-2021-24293

CWE-79
 
 
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.

 
2021-02-09
 
CVE-2020-35943

CWE-352
 
 
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

 
 
CVE-2020-35942

CWE-352
 
 
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

 
2020-02-11
 
CVE-2013-3684

CWE-434
 
 
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

 
2020-01-30
 
CVE-2013-0291

CWE-200
 
 
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

 
2019-11-26
 
CVE-2015-9538

CWE-22
 
 
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

 
 
CVE-2015-9537

CWE-79
 
 
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.

 
2019-08-27
 
CVE-2019-14314

CWE-89
 
 
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.10 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.

 

Copyright 2024, cxsecurity.com

 

Back to Top