CVE-2015-9538

The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

• CWE-22

• https://cxsecurity.com/issue/WLB-2015080165Exploit, Third Party Advisory
• https://cybersecurityworks.com/zerodays/cve-2015-9538-nextgen.htmlExploit, Third Party Advisory
• https://github.com/cybersecurityworks/Disclosed/issues/2Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/135114/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/nextgen-gallery/#developersRelease Notes, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2015/08/28/4Exploit, Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2015/09/01/7Mailing List, Third Party Advisory
• https://cxsecurity.com/issue/WLB-2015080165Exploit, Third Party Advisory
• https://cybersecurityworks.com/zerodays/cve-2015-9538-nextgen.htmlExploit, Third Party Advisory
• https://github.com/cybersecurityworks/Disclosed/issues/2Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/135114/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://wordpress.org/plugins/nextgen-gallery/#developersRelease Notes, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2015/08/28/4Exploit, Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2015/09/01/7Mailing List, Third Party Advisory

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9532The Easy Digital Downloads (EDD) Digital Store theme for Wor…6.1
• CVE-2015-9533The Easy Digital Downloads (EDD) Lattice theme for WordPress…6.1
• CVE-2015-9534The Easy Digital Downloads (EDD) Quota theme for WordPress, …6.1
• CVE-2015-9535The Easy Digital Downloads (EDD) Shoppette theme for WordPre…6.1
• CVE-2015-9536The Easy Digital Downloads (EDD) Twenty-Twelve theme for Wor…6.1
• CVE-2015-9537The NextGEN Gallery plugin before 2.1.10 for WordPress has m…5.4
• CVE-2015-9539The Fast Secure Contact Form plugin before 4.0.38 for WordPr…6.1
• CVE-2015-9540Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url…6.1
• CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion a…7.5
• CVE-2015-9542add_password in pam_radius_auth.c in pam_radius 1.4.0 does n…7.5
• CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.…3.3
• CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5. The…7.1