CVE-2012-4919
CVE-2012-4919 is a critical-severity vulnerability in Gallery Project Gallery with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-829.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v2: 7.5
- EPSS exploit prediction: 3% (85th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-829
- Affected product: Gallery Project Gallery
- Published:
- Last modified:
Description
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
Frequently asked questions
- What is CVE-2012-4919?
- Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
- How severe is CVE-2012-4919?
- CVE-2012-4919 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2012-4919 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2012-4919?
- CVE-2012-4919 affects Gallery Project Gallery. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2012-4919?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2012-4919 published?
- CVE-2012-4919 was published on 2020-01-22 and last updated on 2026-06-16.
References
Affected products (1)
- cpe:2.3:a:gallery_project:gallery:1.4:*:*:*:*:wordpress:*:*
More vulnerabilities in Gallery Project Gallery
- CVE-2004-0522 — Critical (CVSS 10.0): Gallery 1.4.3 and earlier allows remote attackers to bypass authentication and obtain Gallery administrator privileges.
- CVE-2004-1466 — High (CVSS 7.5): The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30…
- CVE-2003-1227 — High (CVSS 7.5): PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in…
- CVE-2002-1412 — High (CVSS 7.5): Gallery photo album package before 1.3.1 allows local and possibly remote attackers to execute arbitrary code via a…
- CVE-2002-2130 — High (CVSS 7.5): publish_xp_docs.php in Gallery 1.3.2 allows remote attackers to execute arbitrary PHP code by modifying the…
- CVE-2002-2123 — High (CVSS 7.5): PHP remote file inclusion vulnerability in publish_xp_docs.php for Gallery 1.3.2 allows remote attackers to inject…
All CVEs affecting Gallery Project Gallery →
Other CWE-829 vulnerabilities
- CVE-2026-1699 — Critical (CVSS 10.0): In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used…
- CVE-2025-70974 — Critical (CVSS 10.0): Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…
- CVE-2025-0982 — Critical (CVSS 10.0): Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute…
- CVE-2021-41037 — Critical (CVSS 10.0): In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via…
- CVE-2022-1161 — Critical (CVSS 10.0): An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix,…
- CVE-2020-4561 — Critical (CVSS 10.0): IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This…