Improper input validation in Menalto Gallery

CVE-2013-2138

The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers to have an unspecified impact via a replay attack.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.027 (84.4th percentile) — read the EPSS interpretation.