CVE-2015-5599
HighSummary
The Powerplay Gallery plugin version 3.3 for WordPress contains multiple SQL injection vulnerabilities in upload.php that allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Risk Assessment
Attackers can exploit these vulnerabilities to gain access to the database, potentially leading to data theft or system compromise.
Recommendation
It is recommended to update the Powerplay Gallery plugin to the latest version to mitigate these vulnerabilities and to monitor logs for potential attack attempts.
Other vulnerabilities in Powerplay Gallery plugin 3.3 for WordPress
See all- CVE-2015-5682High
The Powerplay Gallery plugin version 3.3 for WordPress contains a vulnerability in upload.php that allows remote attackers to create arbitrary directories by manipulating the targetDir variable.
- CVE-2015-5681High
The Powerplay Gallery plugin version 3.3 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.