CVE-2021-24139

—1

CVSS 3.1

9.8 critical

EPSS

6%p92

Published

Mar 18, 2021 (Mar 18, 2021)

Modified

Jun 17, 2026

Description

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

Vendors: 10web
Products: photo gallery
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.5%)

In the news2 stories

July 2026 CVE Landscape

Recorded FutureAug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248 CVE-2008-4128 CVE-2017-17215+78 CVEs1

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

The Hacker NewsJul 23, 12:20 UTC · Jul 23, 2026Malware in the wildCVE-2018-11511 CVE-2021-24139 CVE-2021-31755+1 CVEs