CVE-2014-3123

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.

Metrics

CVSS 2.0 2.1/10AV:N/AC:H/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-31246.7The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash CVE-2014-31256.2Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modif CVE-2014-31277.1dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch prog CVE-2014-31295.0The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a CVE-2014-31304.6The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict CVE-2014-31314.0SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an un CVE-2014-31324.0SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an CVE-2014-31335.0SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems reg CVE-2014-31344.3Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web CVE-2014-31354.3Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML CVE-2014-31368.8Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote attackers to hijack t CVE-2014-31376.8Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote atta