CVE-2015-4617

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Steven Ellis	Easy2map-photos WordPress Plugin	1.09

References

http://www.vapidlabs.com/advisory.php?v=130Exploit, Third Party Advisory
https://wordpress.org/plugins/easy2map-photosProduct, Third Party Advisory
http://www.vapidlabs.com/advisory.php?v=130Exploit, Third Party Advisory
https://wordpress.org/plugins/easy2map-photosProduct, Third Party Advisory

Timeline

Published: Feb 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-46198.8Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.CVE-2015-46207.8name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DN CVE-2015-46247.5Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.CVE-2015-46254.6Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privilege CVE-2015-46267.5B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a nega CVE-2015-46279.8SQL injection vulnerability in Pragyan CMS 3.0.CVE-2015-46286.5SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authen CVE-2015-46299.8Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication,CVE-2015-46308.0Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and CVE-2015-46315.4Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x CVE-2015-46327.5Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before CVE-2015-46339.8Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1