CVE-2019-14798

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-147996.1The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14804.3An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi CVE-2019-148005.3The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via CVE-2019-148019.8The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.CVE-2019-148025.3HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template renderin CVE-2019-148044.8studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.CVE-2019-148054.8studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.CVE-2019-148067.5Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same mac CVE-2019-148076.1In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecial CVE-2019-148086.8An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, CVE-2019-148099.8net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applica CVE-2019-14814.3An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi