CVE-2014-1905

Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

9.79% chance of exploitation in the next 30 days, 95th percentile

Published

2014-12-29

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/31986

References

• CVE Record
• NVD entry

Related

• CVE-2014-1904
• CVE-2014-1906
• CVE-2014-1903
• CVE-2014-1907
• CVE-2014-1889
• CVE-2014-1908