PT-2026-99392 · WordPress · Wp Youtube Gallery
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
YouTube Gallery versions 1.0.0 through 5.7.2
Description
An unauthenticated SQL injection exists in the video search functionality and the router that maps friendly video URLs to database rows. This flaw allows attackers to inject SQL commands into read queries without requiring authentication. Anyone capable of loading a page containing a gallery can exploit this issue.
Recommendations
Update to version 5.7.3.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Youtube Gallery