CVE-2015-1784: imagely nextgen_gallery
Vulnerability summary
CVE-2015-1784 is a high (CVSS 8.8) vulnerability in imagely nextgen_gallery. EPSS estimates a 1.99% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-07-2022PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.99%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
-0.02 pp
From 2.02% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nettitude.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Imagely1 product
- nextgen_gallery< 2.0.77.3
Wordpress1 product
- nextgen-gallery< 2.0.77.3
2 vendors · 2 products
References
3 links- blog.nettitude.com/uk/crsf-and-unsafe-arbitrary-file-upload-in-nextgen-gallery-plugin-for-wordpressX Refsource MISCExploitThird Party Advisory