CVE-2015-7527

EUVD-2015-7446
lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
cool_video_gallery_projectcool_video_gallery
1.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html
http://www.openwall.com/lists/oss-security/2015/12/02/9
http://www.securityfocus.com/archive/1/537051/100/0/threaded
http://www.vapidlabs.com/advisory.php?v=158
https://wordpress.org/support/topic/command-injection-vulnerability-in-v19
https://wpvulndb.com/vulnerabilities/8348
http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html
http://www.openwall.com/lists/oss-security/2015/12/02/9
http://www.securityfocus.com/archive/1/537051/100/0/threaded
http://www.vapidlabs.com/advisory.php?v=158
https://wordpress.org/support/topic/command-injection-vulnerability-in-v19
https://wpvulndb.com/vulnerabilities/8348