CVE-2015-9228

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/10/27/6Mailing List, Third Party Advisory
https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.html
https://github.com/cybersecurityworks/Disclosed/issues/6Vendor Advisory
https://packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/nextgen-gallery/#developersVendor Advisory
https://wpvulndb.com/vulnerabilities/9758
http://www.openwall.com/lists/oss-security/2015/10/27/6Mailing List, Third Party Advisory
https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.html
https://github.com/cybersecurityworks/Disclosed/issues/6Vendor Advisory
https://packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.htmlThird Party Advisory, VDB Entry
https://wordpress.org/plugins/nextgen-gallery/#developersVendor Advisory
https://wpvulndb.com/vulnerabilities/9758

Timeline

Published: Sep 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92294.8In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated CVE-2015-92304.8In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f CVE-2015-92317.5iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 ve CVE-2015-92325.3The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Al CVE-2015-92338.8The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to CVE-2015-92347.2The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform CVE-2015-92359.8In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmet CVE-2015-92365.3Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at w CVE-2015-92385.3secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, CVE-2015-92397.5ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.CVE-2015-92407.5Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched CVE-2015-92417.5Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of s