CVE-2015-5599

Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.

• CWE-89

• http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jul/64Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/07/20/1Exploit, Mailing List, Third Party Advisory, VDB Entry
• http://www.vapid.dhs.org/advisory.php?v=132Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/132671/WordPress-WP-PowerPlayGallery-3.3-File-Upload-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jul/64Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/07/20/1Exploit, Mailing List, Third Party Advisory, VDB Entry
• http://www.vapid.dhs.org/advisory.php?v=132Exploit, Third Party Advisory

Published

Aug 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5593The sanitize_string function in Zenphoto before 1.4.9 does n…6.1
• CVE-2015-5594The sanitize_string function in ZenPhoto before 1.4.9 utiliz…
• CVE-2015-5595Cross-site request forgery (CSRF) vulnerability in admin.php…6.5
• CVE-2015-5596Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5597Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5598Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-5600The kbdint_next_device function in auth2-chall.c in sshd in …8.1
• CVE-2015-5601edx-platform before 2015-07-20 allows code execution by priv…
• CVE-2015-5602sudoedit in Sudo before 1.8.15 allows local users to gain pr…
• CVE-2015-5603The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA…
• CVE-2015-5605The regular-expression implementation in Google V8, as used …
• CVE-2015-5606Vordel XML Gateway (acquired by Axway) version 7.2.2 could a…