vulnerability

WordPress Plugin: nextgen-gallery: CVE-2016-6565: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Try Surface Command
Back to search
Severity
6
CVSS
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
Published
Nov 15, 2016
Added
May 15, 2025
Modified
Jun 24, 2025

Description

The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).

Solution

nextgen-gallery-plugin-cve-2016-6565

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today