Extension WordPress
Vulnérabilités Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, page 2
Cette page rassemble les failles publiées pour Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
44 fiches
WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 – Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF…
*-3.4.7
3.5.0
17/12/2020
NextGEN Gallery <= 3.2.10 – SQL Injection
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
[*, 3.2.11)
3.2.11
27/08/2019
Freemius SDK <= 2.2.3 – Missing Authorization to Arbitrary Options Update
The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level…
[*, 3.1.7)
3.1.7
25/02/2019
NextGen Gallery <= 3.1.5 – PHP Object Injection
The NextGen Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.1.5. This is due to the plugin unserializing serialized data obtained via user supplied input from the `sortorder` parameter. This…
*-3.1.5
3.1.6
04/02/2019
WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 – Sensitive Information Disclosure
In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.
*-2.2.46
2.2.50
02/03/2018
NextGEN Gallery <= 2.2.44 – Cross-Site Scripting via image alt and title text
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability…
*-2.2.44
2.2.45
14/02/2018
NextGen Gallery <= 2.1.77 – SQL Injection
The NextGen Gallery plugin for WordPress is vulnerable to SQL Injection via the ‘$container_ids’ string in versions up to, and including, 2.1.77 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
*-2.1.77
2.1.79
17/02/2017
NextGen Gallery <= 2.1.56 – Remote File Inclusion
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the…
*-2.1.56
2.1.57
15/11/2016
NextGEN Gallery <= 2.1.56 – Authenticated Local File Inclusion & SQL injection
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
*-2.1.56
2.1.57
15/11/2016
NextGen Gallery <= 2.1.10 – Unrestricted File Upload
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
*-2.1.10
2.1.15
23/12/2015
WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 – Authenticated (Admin+) Cross-Site Scripting
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
*-2.1.15
2.1.23
14/09/2015
NextGen Gallery <= 2.1.9 – Cross-Site Scripting
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.
*-2.1.9
2.1.10
31/08/2015
NextGen Gallery <= 2.1.7 – Path Traversal
The NextGen Gallery plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.1.7 via the browse_folder AJAX action and the 'dir' parameter. This allows authenticated attackers to read the contents of arbitrary files…
*-2.1.7
2.1.9
28/08/2015
NextGen Gallery <= 2.1.10 – Local File Inclusion
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
*-2.1.10
2.1.15
28/08/2015
WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 – Arbitrary File Upload
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security…
[*, 2.0.77.3)
2.0.77.3
25/03/2015
WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 – Cross-Site Request Forgery
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security…
[*, 2.0.77.3)
2.0.77.3
25/03/2015
NextGen Gallery <= 2.0.65 – Arbitrary File Upload
The NextGen Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the is_image_file function in versions up to, and including, 2.0.65. This makes it possible for authenticated attackers with upload…
*-2.0.65
2.0.66
20/05/2014
NextGen Gallery <= 2.0 – Path Traversal
The NextGen Gallery plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.0 via the 'dir' parameter. This allows attackers to read the contents of arbitrary files on the server, which can contain…
*-2.0
2.0.7
18/02/2014
WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 – Arbitrary File Upload
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
*-1.9.12
1.9.13
13/06/2013
WordPress Gallery Plugin – NextGEN Gallery 1.9.10 – 1.9.11 – Full Path Disclosure
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability.
1.9.10-1.9.11
2.0.0
14/02/2013
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.