VIR Vulnerability Intelligence Relay

CVE-2015-9228

high
Published 2017-09-12 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
8.8

Description

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
imagelynextgen_gallery1.5.0
imagelynextgen_gallery1.5.1
imagelynextgen_gallery1.5.2
imagelynextgen_gallery1.5.3
imagelynextgen_gallery1.5.4
imagelynextgen_gallery1.5.5
imagelynextgen_gallery1.6.0
imagelynextgen_gallery1.6.1
imagelynextgen_gallery1.6.2
imagelynextgen_gallery1.7.0
imagelynextgen_gallery1.7.1
imagelynextgen_gallery1.7.2
imagelynextgen_gallery1.7.3
imagelynextgen_gallery1.7.4
imagelynextgen_gallery1.8.0
imagelynextgen_gallery1.8.1
imagelynextgen_gallery1.8.2
imagelynextgen_gallery1.8.3
imagelynextgen_gallery1.8.4
imagelynextgen_gallery1.9.0
imagelynextgen_gallery1.9.1
imagelynextgen_gallery1.9.2
imagelynextgen_gallery1.9.3
imagelynextgen_gallery1.9.5
imagelynextgen_gallery1.9.6
imagelynextgen_gallery1.9.7
imagelynextgen_gallery1.9.8
imagelynextgen_gallery1.9.10
imagelynextgen_gallery1.9.11
imagelynextgen_gallery1.9.12
imagelynextgen_gallery1.9.13
imagelynextgen_gallery2.0
imagelynextgen_gallery2.0.7
imagelynextgen_gallery2.0.11
imagelynextgen_gallery2.0.14
imagelynextgen_gallery2.0.17
imagelynextgen_gallery2.0.21
imagelynextgen_gallery2.0.23
imagelynextgen_gallery2.0.25
imagelynextgen_gallery2.0.27
imagelynextgen_gallery2.0.30
imagelynextgen_gallery2.0.31
imagelynextgen_gallery2.0.33
imagelynextgen_gallery2.0.40
imagelynextgen_gallery2.0.57
imagelynextgen_gallery2.0.58
imagelynextgen_gallery2.0.59
imagelynextgen_gallery2.0.61
imagelynextgen_gallery2.0.63
imagelynextgen_gallery2.0.65
imagelynextgen_gallery2.0.66
imagelynextgen_gallery2.0.66.16
imagelynextgen_gallery2.0.66.17
imagelynextgen_gallery2.0.66.26
imagelynextgen_gallery2.0.66.27
imagelynextgen_gallery2.0.66.29
imagelynextgen_gallery2.0.66.31
imagelynextgen_gallery2.0.66.33
imagelynextgen_gallery2.0.71
imagelynextgen_gallery2.0.74
imagelynextgen_gallery2.0.76
imagelynextgen_gallery2.0.77
imagelynextgen_gallery2.0.78
imagelynextgen_gallery2.0.78.1
imagelynextgen_gallery2.0.79
imagelynextgen_gallery2.1.0
imagelynextgen_gallery2.1.2
imagelynextgen_gallery2.1.7
imagelynextgen_gallery2.1.9
imagelynextgen_gallery2.1.10

References

CWEs

CWE-434

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.