CVE-2021-24139

CRITICAL EXPLOITED NUCLEI

10web Photo Gallery < 1.5.55 - SQL Injection via bwg_search_x Parameter

Title source: llm

Exploitation Summary

CVE-2021-24139 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

Nuclei Templates (1)

10Web Photo Gallery < 1.5.55 - SQL Injection

CRITICALVERIFIEDby riteshs4hu

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/2e33088e-7b93-44af-aa6a-e5d924f86e28

Scores

CVSS v3 9.8

EPSS 0.0542

EPSS Percentile 91.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-01-24

CWE

CWE-89

Status published

Products (1)

10web/photo_gallery < 1.5.55

Published Mar 18, 2021

Tracked Since Feb 18, 2026