CVE-2015-7527

lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.

Score

CVSS 2.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2015-12-17

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Cool Video Gallery (Cool Video Gallery Project)

References

• http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html
• http://www.openwall.com/lists/oss-security/2015/12/02/9
• http://www.securityfocus.com/archive/1/537051/100/0/threaded
• http://www.vapidlabs.com/advisory.php?v=158
• https://wordpress.org/support/topic/command-injection-vulnerability-in-v19
• https://wpvulndb.com/vulnerabilities/8348