CVE-2014-5460: tribulant tibulant_slideshow_gallery Improper Input Validation
Vulnerability summary
CVE-2014-5460 is a high (CVSS 8.8) Improper Input Validation vulnerability in tribulant tibulant_slideshow_gallery. EPSS estimates a 70.89% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 11-09-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
70.89%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 70.89% on 24-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
5 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (whitexploit.blogspot.mx)
Maturity: unknown
Wordpress SlideShow Gallery Authenticated File Upload
exploit/unix/webapp/wp_slideshowgallery_upload
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Tribulant1 product
- tibulant_slideshow_gallery≤ 1.4.6 | 1.4 | 1.4.1 | 1.4.2 | 1.4.3 | 1.4.4 | 1.4.5
Wordpress1 product
- slideshow-gallery< 1.4.7
2 vendors · 2 products
References
9 links- packetstormsecurity.com/files/128069/WordPress-Slideshow-Gallery-1.4.6-Shell-Upload.htmlX Refsource MISCExploit