CVE-2015-9228
N/A
Published: September 12, 2017 at 08:00 AM UTC
Updated: June 17, 2026 at 12:36 AM UTC
1 product affected across 1 vendorNextGEN Gallery
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 4%
Description
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
NextGEN Gallery· Imagelywordpress-plugin
95%1.5.01.5.11.5.21.5.31.5.41.5.51.6.01.6.11.6.21.7.01.7.11.7.21.7.31.7.41.8.01.8.11.8.21.8.31.8.41.9.01.9.11.9.101.9.111.9.121.9.131.9.21.9.31.9.51.9.61.9.71.9.82.02.0.112.0.142.0.172.0.212.0.232.0.252.0.272.0.302.0.312.0.332.0.402.0.572.0.582.0.592.0.612.0.632.0.652.0.662.0.66.162.0.66.172.0.66.262.0.66.272.0.66.292.0.66.312.0.66.332.0.72.0.712.0.742.0.762.0.772.0.782.0.78.12.0.792.1.02.1.102.1.22.1.72.1.9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (6)
x_refsource_MISCMailing ListThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2015/10/27/6x_refsource_MISC
Source: [email protected]
https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.htmlx_refsource_MISCVendor Advisory
Source: [email protected]
https://github.com/cybersecurityworks/Disclosed/issues/6x_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
https://packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.htmlx_refsource_MISCVendor Advisory
Source: [email protected]
https://wordpress.org/plugins/nextgen-gallery/#developersQuick Info
StatusMODIFIED
CWE
CWE-434
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card