CVE-2014-1905
NONE EPSS 95.2%
Published Dec 29, 201411y ago · Modified Jun 17, 20262w ago
Published Dec 29, 2014 11y ago
Last Modified Jun 17, 2026 2w ago
Description
Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename.
Threat Intelligence
EPSS Exploit Probability
95.2% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-77 Command Injection Injection
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| videowhisper | videowhisper_live_streaming_integration | * | ≤4.27.4 |
References 1
- htbridge.com https://www.htbridge.com/advisory/HTB23199
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.