Awesomemotive Nextgen Gallery vulnerabilities

1 vulnerability

Known vulnerabilities in Awesomemotive Nextgen Gallery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CriticalCVE-2026-9059awesomemotive · nextgen gallery +1 more5mo agoNextGEN Gallery - SQL InjectionNextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'. The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.EPSS0.37%