CVE-2021-24915: Improper Neutralization of Special Elements used in an SQL Command

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

Contest Gallery < 13.1.0.7 - Subscriber+ Email Address Disclosure

The plugin does not have any proper access controls when exporting users from a gallery, which could allow any authenticated users such as subscriber to list all users from the blog, disclosing their username and email address POST...

WordPress Contest Gallery plugin <= 13.1.0.5 - Missing Access Controls to Unauthenticated SQL injection (SQLi) / Email Address Disclosure vulnerability

Missing Access Controls to Unauthenticated SQL injection SQLi / Email Address Disclosure vulnerability discovered by Tyler Miller in WordPress Contest Gallery plugin versions = 13.1.0.5. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.6...

WordPress Contest Gallery plugin <= 13.1.0.6 - Email Address Disclosure vulnerability

Email Address Disclosure vulnerability discovered by WPScanTeam in WordPress Contest Gallery plugin versions = 13.1.0.6. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.7...

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users...

WordPress Contest Gallery plugin <= 10.4.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Cryptography Laboratory in WordPress Contest Gallery plugin versions = 10.4.4. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 10.4.5...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5974

The CVE-2019-5974 entry describes a Cross-site request forgery (CSRF) vulnerability in the WordPress Contest Gallery plugin, affecting versions prior to 10.4.5. According to the connected sources, an attacker could hijack the administrator’s authenticated session via unspecified vectors when a lo...

CVE-2019-5974: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

PT-2019-17908

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 10.4.5 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. The exact vectors used for the attack are not specified. Recommendations For versio...

WordPress Plugin "Contest Gallery" vulnerable to cross-site request forgery

Overview WordPress Plugin "Contest Gallery" provided by Contest-Gallery contains a cross-site request forgery vulnerability CWE-352. Okazawa Yoshihiro of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University directly reported this vulnerability to...

WordPress Contest Gallery Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Contest Gallery plugin is a plugin for uploading and displaying images. A cross-site request forgery vulnerability exists in WordPress...

Contest Gallery <= 10.4.4 - Cross-Site Request Forgery (CSRF)

The Contest Gallery – Photo Contest Plugin for WordPress WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

JVN#80925867: WordPress Plugin "Contest Gallery” vulnerable to cross-site request forgery

WordPress Plugin "Contest Gallery” provided by Contest-Gallery contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information...

Cross-site scripting vulnerability in wordpress plugin contest-gallery

Contest Gallery is a Wordpress plugin. The Wordpress plugin contest-gallery suffers from an xss vulnerability due to improper filtering of user input, which allows attackers to frame malicious web pages and trick users into parsing them to execute arbitrary code...

Wordpress Contest Gallery plugin XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin contest-gallery XSS Vulnerability Software Link: https://wordpress.org/plugins/contest-gallery/ Version:2.03 Google dork: inurl:/wp-content/plugins/contest-gallery The code in...