VULNERABILITY INTELLIGENCE

CVE-2014-1905

CVSS score10 HIGH
EPSS probability9.79%
CISA KEVNot currently listed
Published2014-12-29
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references