CVE-2013-5962
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery...
CVE-2013-5962 is a medium vulnerability (CVSS 5.1) in Envato Complete Gallery Manager Plugin, published September 30, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.8%, the 96th percentile. No source names a fixed version.
- Severity
- 5.1 MediumCVSS 2.0, NVD
- Exploit chance
- 14.8%EPSS, 96th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin Complete Gallery Manager 3.3.3 - Arbitrary File Upload | 2013-09-18 |
What each source reports
NVD Score used
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
- Record
CVE-2013-5962- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
- Record
CVE-2013-5962- Updated
- 2026-11-02
EUVDEUVD-2013-5792No score
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
- Record
EUVD-2013-5792- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9vx7-4qrw-wfw5No score
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery...
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
- Record
GHSA-9vx7-4qrw-wfw5- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
packetstormsecurity.com/files/123303
codecanyon.net/item/complete-gallery-manager-for-wordpress/2418606
vulnerability-lab.com/get_content.php?id=1080
exploit-db.com/exploits/28377
exchange.xforce.ibmcloud.com/vulnerabilities/87172
archives.neohapsis.com/archives/bugtraq/2013-09/0090.html
secunia.com/advisories/54894
nvd.nist.gov/vuln/detail/CVE-2013-5962
github.com/advisories/GHSA-9vx7-4qrw-wfw5