Unscored CVE-2015-5682 EUVD-2015-5632GHSA-7p8r-r5xw-x79q

upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to…

Published May 23, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Description

upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.

References

http://www.vapid.dhs.org/advisory.php?v=132
[oss-security] 20150727 Re: Remote file upload vulnerability & SQLi in wordpress plugin wp-powerplaygallery v3.3 mailing-list