CVE-2015-4615

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Steven Ellis	Easy2map-photos WordPress Plugin	1.09

References

http://www.vapid.dhs.org/advisory.php?v=130Exploit, Third Party Advisory
https://wordpress.org/plugins/easy2map-photosProduct, Third Party Advisory
http://www.vapid.dhs.org/advisory.php?v=130Exploit, Third Party Advisory
https://wordpress.org/plugins/easy2map-photosProduct, Third Party Advisory

Timeline

Published: Feb 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-46165.0Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers CVE-2015-46177.5Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying f CVE-2015-46198.8Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.CVE-2015-46207.8name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DN CVE-2015-46247.5Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.CVE-2015-46254.6Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privilege CVE-2015-46267.5B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a nega CVE-2015-46279.8SQL injection vulnerability in Pragyan CMS 3.0.CVE-2015-46286.5SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authen CVE-2015-46299.8Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication,CVE-2015-46308.0Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and CVE-2015-46315.4Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x