CVE-2019-14798

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...

CVE-2019-14798

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...

CVE-2019-14798

The CVE-2019-14798 case concerns the WordPress plugin Photo Gallery by 10Web (before 1.5.25). Affected component: wp-admin/admin-ajax.php handling of action=shortcode_bwg with the tagtext parameter. Root cause: Authenticated Local File Inclusion via directory traversal, enabling access to files o...

PT-2019-13842

Name of the Vulnerable Software and Affected Versions 10Web Photo Gallery plugin versions prior to 1.5.23 Description The issue is related to an authenticated stored XSS. Recommendations For versions prior to 1.5.23, update to version 1.5.23 or later to resolve the issue...

PT-2019-13843

Name of the Vulnerable Software and Affected Versions 10Web Photo Gallery plugin versions prior to 1.5.25 Description The issue concerns an Authenticated Local File Inclusion vulnerability via directory traversal. This is specifically related to the tagtext parameter in the...

CVE-2019-14798: Improper Limitation of a Pathname to a Restricted Directory

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...

CVE-2019-14797: Improper Neutralization of Input During Web Page Generation

The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS...

CVE-2019-14313

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php...

Sql injection

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php...

CVE-2019-14313

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php...

CVE-2019-14313

The CVE-2019-14313 issue affects the WordPress Photo Gallery (10Web) plugin versions prior to 1.5.31. The vulnerability is a SQL injection in filemanager/model.php that could allow a remote attacker to execute arbitrary SQL commands on the affected site. The NVD and Red Hat entries corroborate a ...

PT-2019-13601 · 10Web · 10Web Photo Gallery

Name of the Vulnerable Software and Affected Versions: 10Web Photo Gallery plugin versions prior to 1.5.31 Description: A SQL injection issue exists, allowing a remote attacker to execute arbitrary SQL commands on the affected system via the filemanager/model.php. Recommendations: For versions...

CVE-2019-14313: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php...

Photo Gallery by 10Web <= 1.5.30 - SQL Injection

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Photo Gallery by 10Web plugin <= 1.5.30 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Tin Duong in WordPress Photo Gallery by 10Web plugin versions = 1.5.30. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.5.31...

WordPress Form Maker by 10Web plugin <= 1.13.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Daniele Scanu in WordPress Form Maker by 10Web plugin versions = 1.13.20. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.3...

Photo Gallery by 10Web <= 1.5.24 - Authenticated LFI

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated LFI security vulnerability...

Photo Gallery by 10Web <= 1.5.22 - Authenticated XSS

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated XSS security vulnerability...

Form Maker by 10Web < 1.13.3 - Authenticated SQL Injection

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

CVE-2019-11590

The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...