High severity8.8NVD Advisory· Published Sep 12, 2017· Updated May 13, 2026
CVE-2015-9228
CVE-2015-9228
Description
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Affected products
70cpe:2.3:a:imagely:nextgen_gallery:1.5.0:*:*:*:*:wordpress:*:*+ 69 more
- cpe:2.3:a:imagely:nextgen_gallery:1.5.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.5.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.5.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.5.3:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.5.4:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.5.5:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.6.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.6.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.6.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.7.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.7.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.7.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.7.3:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.7.4:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.8.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.8.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.8.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.8.3:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.8.4:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.10:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.11:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.12:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.13:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.3:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.5:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.6:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.7:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:1.9.8:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.11:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.14:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.17:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.21:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.23:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.25:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.27:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.30:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.31:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.33:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.40:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.57:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.58:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.59:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.61:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.63:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.65:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.16:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.17:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.26:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.27:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.29:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.31:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66.33:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.66:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.71:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.74:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.76:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.77:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.78.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.78:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.79:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0.7:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.1.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.1.10:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.1.2:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.1.7:*:*:*:*:wordpress:*:*
- cpe:2.3:a:imagely:nextgen_gallery:2.1.9:*:*:*:*:wordpress:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.openwall.com/lists/oss-security/2015/10/27/6nvdMailing ListThird Party Advisory
- github.com/cybersecurityworks/Disclosed/issues/6nvdVendor Advisory
- packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.htmlnvdThird Party AdvisoryVDB Entry
- wordpress.org/plugins/nextgen-gallery/nvdVendor Advisory
- cybersecurityworks.com/zerodays/cve-2015-9228-crony.htmlnvd
- wpvulndb.com/vulnerabilities/9758nvd
News mentions
0No linked articles in our index yet.