WordPress Image Optimizer by 10web Plugin < 1.0.27 is vulnerable to Cross Site Scripting (XSS)

Software Image Optimizer by 10web Type Plugin Vulnerable versions 1.0.27 Fixed in 1.0.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2122 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b135df868a4f Credits Phạm Ngọc Khá...

Image Optimizer by 10web < 1.0.27 - Admin+ Path Traversal

The plugin does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root. - Payload: ../../../../../../../../../../../../../../../../../../../ - At the "Other...

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link. Make a logged in admin...

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link. PoC Make a logged in...

WordPress Image Optimizer by 10web Plugin < 1.0.27 is vulnerable to Directory Traversal

Software Image Optimizer by 10web Type Plugin Vulnerable versions 1.0.27 Fixed in 1.0.27 OWASP Top 10 A1: Injection Classification Directory Traversal CVE CVE-2023-2117 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dd4f37114439 Credits Chien Vuong Required privilege...

WordPress Photo Gallery by 10Web Plugin < 1.8.15 is vulnerable to Directory Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions 1.8.15 Fixed in 1.8.15 OWASP Top 10 A6: Security Misconfiguration Classification Directory Traversal CVE CVE-2023-1427 Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID f915d3bc46f4 Credits Nguyen Huu Do Require...

WordPress Photo Gallery by 10Web Plugin < 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions 1.8.3 Fixed in 1.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4058 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ee71d42f5999 Credits Krzysztof Zając...

CVE-2023-1427 Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal

The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector...

CVE-2023-1427

The CVE-2023-1427 entry describes a path traversal vulnerability in the WordPress plugin Photo Gallery by 10Web, affecting versions prior to 1.8.15. The root cause is that uploaded files were not consistently kept within the plugin’s intended uploads directory, allowing high-privilege users to pl...

WordPress Plugin Photo Gallery by 10Web 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-1427: Undefined Security Weakness

The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector...

Sql injection

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0037 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0037

The 10Web Map Builder for Google Maps WordPress plugin, in versions prior to 1.0.73 , is vulnerable to SQL injection . The root cause is the failure to properly sanitise and escape certain parameters used in an SQL statement triggered by an AJAX action . Because this action is accessible to unaut...

CVE-2023-0037: Undefined Security Weakness

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

WordPress 10Web Map Builder for Google Maps Plugin < 1.0.73 is vulnerable to SQL Injection

Software 10Web Map Builder for Google Maps Type Plugin Vulnerable versions 1.0.73 Fixed in 1.0.73 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0037 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID d12f4275dd8a Credits Daniel Krohmer Fraunhofer IESE...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Plugin <= 2.13.44 is vulnerable to Cross Site Scripting (XSS)

Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Type Plugin Vulnerable versions = 2.13.44 Fixed in 2.13.45 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownersh...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Plugin <= 2.12.22 is vulnerable to SQL Injection

Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Type Plugin Vulnerable versions = 2.12.22 Fixed in 2.12.23 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID e811de61c5fb Credi...

WordPress 10Web Map Builder for Google Maps Plugin < 1.0.72 is vulnerable to Cross Site Scripting (XSS)

Software 10Web Map Builder for Google Maps Type Plugin Vulnerable versions 1.0.72 Fixed in 1.0.72 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4758 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 6eb19701ed4e Credits...

CVE-2022-4058

CVE-2022-4058 affects the WordPress plugin Photo Gallery by 10Web, versions before 1.8.3. The root cause is failure to validate/escape certain parameters before outputting them in JavaScript on another page, enabling a Stored XSS when a logged-in admin visits a crafted URL. The CVSS base score is...