https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T17:05:27.683411+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-81650 CVE-2026-81650 — NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import 2026-10-06T17:05:29.765478+00:00

Affected: Unknown Photo Gallery, Sliders, Proofing and Themes

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.