Show filters
179 Total Results
Displaying 71-80 of 179
Sort by:
Attacker Value
Unknown
CVE-2021-40814
Disclosure Date: September 08, 2021 (last updated February 23, 2025)
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.
0
Attacker Value
Unknown
CVE-2021-24363
Disclosure Date: August 16, 2021 (last updated February 23, 2025)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector
0
Attacker Value
Unknown
CVE-2021-24362
Disclosure Date: August 16, 2021 (last updated February 23, 2025)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
0
Attacker Value
Unknown
CVE-2021-24462
Disclosure Date: August 02, 2021 (last updated February 23, 2025)
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
0
Attacker Value
Unknown
CVE-2021-24310
Disclosure Date: June 01, 2021 (last updated February 22, 2025)
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117
0
Attacker Value
Unknown
CVE-2021-24291
Disclosure Date: May 14, 2021 (last updated February 22, 2025)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
0
Attacker Value
Unknown
CVE-2021-24139
Disclosure Date: March 18, 2021 (last updated February 22, 2025)
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
0
Attacker Value
Unknown
CVE-2020-14962
Disclosure Date: June 22, 2020 (last updated February 21, 2025)
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.
0
Attacker Value
Unknown
CVE-2020-9335
Disclosure Date: February 25, 2020 (last updated February 21, 2025)
Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
0
Attacker Value
Unknown
CVE-2015-1394
Disclosure Date: February 08, 2020 (last updated February 21, 2025)
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
0
