CVE-2015-5599

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/64Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/20/1Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.vapid.dhs.org/advisory.php?v=132Exploit, Third Party Advisory
http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/64Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/20/1Exploit, Mailing List, Third Party Advisory, VDB Entry
http://www.vapid.dhs.org/advisory.php?v=132Exploit, Third Party Advisory

Timeline

Published: Aug 18, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-56008.1The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-intera CVE-2015-56018.8edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.CVE-2015-56027.2sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multipl CVE-2015-56036.5The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecifie CVE-2015-56055.0The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote CVE-2015-56067.5Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted reque CVE-2015-56078.8Cross-site request forgery in the REST API in IPython 2 and 3.CVE-2015-56086.1Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.CVE-2015-56099.1Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary file CVE-2015-56104.0The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different CVE-2015-56118.3Unspecified vulnerability in Uconnect before 15.26.1, as used in certain Fiat Chrysler Automobiles (FCA) from 2013 to 2015 models, allows re CVE-2015-56124.3Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML