CVE-2021-24139

CRITICAL EXPLOITED NUCLEI

10web Photo Gallery < 1.5.55 - SQL Injection

Title source: rule

Description

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

Nuclei Templates (1)

10Web Photo Gallery < 1.5.55 - SQL Injection

CRITICALVERIFIEDby riteshs4hu

References (1)

[Third Party Advisory] https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28

Scores

CVSS v3 9.8

EPSS 0.4839

EPSS Percentile 97.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-01-24

CWE

CWE-89

Status published

Products (1)

10web/photo_gallery < 1.5.55

Published Mar 18, 2021

Tracked Since Feb 18, 2026