Vulnerability · Published Mar 18, 2021 · Assigned by WPScan
CVE-2021-24139Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Photo Gallery by 10Web from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)5.5%top 7.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Photo Gallery by 10Web | 1.5.55 – before 1.5.55 |
Weakness: CWE-89