CVE-2024-46333

An authenticated cross-site scripting XSS vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function...

CVE-2024-7817

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack...

CVE-2024-7817

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack...

CVE-2024-7818

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-7818 Misiek Photo Album <= 1.4.3 - Stored XSS via CSRF

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-7817 Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack...

CVE-2024-7818 Misiek Photo Album <= 1.4.3 - Stored XSS via CSRF

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-7817 Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack...

CVE-2024-7817

CVE-2024-7817 affects the Misiek Photo Album WordPress plugin, version ≤ 1.4.3, which lacks CSRF checks in some areas and could let an attacker cause a logged-in user to delete arbitrary albums via CSRF. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium) with no confidentiality impact, ...

CVE-2024-7818: Improper Neutralization of Input During Web Page Generation

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

WordPress plugin Misiek Photo Album 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin.... A security vulnerability...

CVE-2024-7817: Cross-Site Request Forgery (CSRF)

The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack...

WordPress plugin Misiek Photo Album 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin.... A security vulnerability...

PT-2024-38605 · WordPress · Misiek Photo Album

Name of the Vulnerable Software and Affected Versions: Misiek Photo Album WordPress plugin versions 1.4.3 and earlier Description: The issue is related to the lack of CSRF checks in some places, as well as missing sanitization and escaping, which could allow attackers to make logged-in admins add...

PT-2024-38604 · WordPress · Misiek Photo Album

Name of the Vulnerable Software and Affected Versions: Misiek Photo Album WordPress plugin versions 1.4.3 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users delete arbitrary albums via a CSRF attack. This...

U.S. Dept Of Defense: CSRF Attack leads to delete album at ████████

The report describes a CSRF vulnerability in the DoD asset ███████, specifically in the feature to create albums for a media collection. The vulnerability allows an attacker to delete a victim's album without the victim's consent, as the delete request is based on GET and lacks CSRF verification...

WordPress Misiek Photo Album plugin <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Daniel Ruf in WordPress Plugin Misiek Photo Album versions = 1.4.3...

WordPress Misiek Photo Album plugin <= 1.4.3 - Album Deletion via CSRF vulnerability

Album Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Misiek Photo Album versions = 1.4.3...

WordPress Misiek Photo Album Plugin <= 1.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Misiek Photo Album Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7817 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e7a1753e88ea Credits Bob Matyas Required...

WordPress Misiek Photo Album Plugin <= 1.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Misiek Photo Album Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7818 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID e6740ef34635 Credits Daniel Ruf Required...