CVE-2015-7527

Published: Dec 17, 2015Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.

Affected (1)

Products: Cool Video Gallery Project: Cool Video Gallery

Cool Video Gallery Project

1 product

Cool Video Gallery

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cool Video Gallery Project Cool Video Gallery	Version 1.9

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2015/12/02/9

Source: secalert@redhat.com

Exploit

http://www.securityfocus.com/archive/1/537051/100/0/threaded

Source: secalert@redhat.com

http://www.vapidlabs.com/advisory.php?v=158

Source: secalert@redhat.com

Exploit

https://wordpress.org/support/topic/command-injection-vulnerability-in-v19

Source: secalert@redhat.com

Exploit

https://wpvulndb.com/vulnerabilities/8348

Source: secalert@redhat.com

http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html