photo_gallery

暂无产品描述。

10webwordpress

关联漏洞

共找到 5 条公开漏洞记录

严重CVE-2021-241392026/01/30

10Web Photo Gallery < 1.5.55 - SQL Injection

WordPress plugin 10Web Photo Gallery versions before 1.5.55 contains a SQL injection caused by unvalidated input in the 'bwg_search_x' parameter in frontend/models/model.php, letting attackers execute arbitrary SQL commands, exploit requires attacker to control the 'bwg_search_x' parameter.

photo_galleryPoC 已收录RCE

CVSS—

中危2023/11/27

Photo Gallery < 1.7.1 - Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting.

photo_galleryPoC 已收录

CVSS—

严重CVE-2022-01692022/03/14

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection

photo_galleryPoC 已收录

CVSS9.8EPSS 52.2%

中危CVE-2021-242912021/05/14

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the gallery_id, tag, album_id and theme_id GET parameters passed to the bwg_frontend_data AJAX action, available to both unauthenticated and authenticated users.

photo_galleryPoC 已收录

CVSS6.1EPSS 14.6%

高危CVE-2014-93122017/08/28

CVE-2014-9312

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.

photo_galleryRCE

CVSS8.8EPSS 76.5%