CVE-2010-5040: PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for...

Security readout for executives and security teams

CVE-2010-5040 affects NP_Gallery 0.94 for Nucleus. The reported flaw could let a remote attacker make the application include external PHP code, potentially leading to server-side code execution. The source data is old and incomplete, so exposure depends on whether this legacy plugin is still installed and reachable. Most likely exposure is legacy Nucleus CMS sites running NP_Gallery plugin 0.94 with the plugin path publicly accessible. The bundle does not identify vendor CPEs or broader affected versions, so asset confirmation is required. Prioritize remediation for internet-facing legacy Nucleus sites. The flaw can lead to code execution, but urgency should be based on confirmed plugin presence because the public record is sparse and no active exploitation evidence is provided. Mitigation focus: Inventory Nucleus CMS sites for NP_Gallery 0.94.; Check vendor or archived project guidance for fixed or replacement versions.; Disable or remove NP_Gallery where it is not required..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.