CVE-2008-2449: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Isaac McGowan phpInstantGallery 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 gallery parameter to a index.php and b image.php, and the 2 imgnum parameter to image.php. NOTE: the provenance of this information is...

PHPInstantGallery 2.0 - 'image.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/29152/info phpInstantGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user...

CVE-2008-0805: Undefined Security Weakness

Unrestricted file upload vulnerability in image.php in PHPizabi 0.848b C1 HFP1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension from the event page, then accessing it via a direct request to the file in system/cache/pictures...

CVE-2006-7103: Undefined Security Weakness

Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to 1 determine directory existence via a ".." in the album parameter in a showalbum action to a ezgallery.php, which produces different responses...

CVE-2006-5108: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the orderid parameter in 1 admin/printorder.php and 2 vieworder.php; the 3 siteurl and 4 lasearchhome parameters and 5 certain language parameters in...

CVE-2006-4166: Undefined Security Weakness

PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image parameter to 1 image.php or 2 image.php2...

CVE-2005-4244: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 1 galleryid parameter to view.php and 2 imageid parameter to image.php...

CVE-2005-3021

CVE-2005-3021 affects vBulletin

CVE-2005-3021: Undefined Security Weakness

image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action...