CVE-2024-3097mediumCWE-862

CVE-2024-3097: falha de média gravidade em smub Photo Gallery, Sliders, Proofing and…

WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

40Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 5.3epss 38%
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
CVEs relacionadas — smub Photo Gallery, Sliders, Proofing and…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-76012HIGHPhoto Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image UploadEPSS 0.8%CVE-2026-76010HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path TraversalEPSS 0.8%CVE-2025-13641HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'EPSS 0.8%CVE-2026-1463HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File InclusionEPSS 0.5%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-5878MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryEPSS 0.4%