CVE-2012-10052
Last modified
CVE-2012-10052 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. EPSS estimates a 1.39% chance of exploitation in the next 30 days.
Description
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2012-10052?
How severe is CVE-2012-10052?
How do I fix CVE-2012-10052?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-10047Cyclope Employee Surveillance Solution versions 6.x are vuln…10
- CVE-2012-10048Zenoss Core 3.x contains a command injection vulnerability i…8.7
- CVE-2012-10049WebPageTest version 2.6 and earlier contains an arbitrary fi…9.3
- CVE-2012-1005Multiple cross-site scripting (XSS) vulnerabilities in Sphin…
- CVE-2012-10050CuteFlow version 2.11.2 and earlier contains an arbitrary fi…9.3
- CVE-2012-10051Photodex ProShow Producer version 5.0.3256 contains a stack-…8.4
- CVE-2012-10053Simple Web Server 2.2 rc2 contains a stack-based buffer over…9.3
- CVE-2012-10054Umbraco CMS versions prior to 4.7.1 are vulnerable to unauth…9.8
- CVE-2012-10055ComSndFTP FTP Server version 1.3.7 Beta contains a format st…9.3
- CVE-2012-10056PHP Volunteer Management System v1.0.2 contains an arbitrary…8.7
- CVE-2012-10057Lattice Semiconductor ispVM System v18.0.2 contains a buffer…8.4
- CVE-2012-10058RabidHamster R4 v1.25 contains a stack-based buffer overflow…10
Are you affected by CVE-2012-10052?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST