631 matches found
CVE-2022-27853
CVE-2022-27853 is an authenticated stored XSS vulnerability in the WordPress plugin Contest Gallery up to version 13.1.0.9. Affected component: Contest Gallery plugin for WordPress; root cause details are not provided beyond the XSS label in the CVE record. The connected sources corroborate the v...
CVE-2022-27853 WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...
CVE-2022-27853: Improper Neutralization of Input During Web Page Generation
Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...
WordPress plugin Contest Gallery 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...
CVE-2022-27853
Authenticated author or higher role Stored Cross-Site Scripting XSS in Contest Gallery WordPress plugin = 13.1.0.9...
WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien in WordPress Contest Gallery plugin versions = 13.1.0.9. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 14.0.0...
WordPress Contest Gallery SQL Injection Vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Contest Gallery SQL injection vulnerability,...
CVE-2021-24915
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
CVE-2021-24915
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
CVE-2021-24915 Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
CVE-2021-24915
The Contest Gallery WordPress plugin (prior to 13.1.0.6) lacks capability checks and does not sanitise/escape cg-search-user-name-original before using it in a SQL statement when exporting gallery users, enabling unauthenticated SQL injection and disclosure of all usernames and email addresses. T...
CVE-2021-24915: Improper Neutralization of Special Elements used in an SQL Command
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...
WordPress SQL注入漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Contest Gallery SQL injection vulnerability,...
PT-2021-16365
Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 13.1.0.6 Description: The issue allows unauthenticated attackers to perform SQL injection attacks and obtain a list of all users registered on the blog, including their username and email...
WordPress Contest Gallery plugin <= 13.1.0.5 - Missing Access Controls to Unauthenticated SQL injection (SQLi) / Email Address Disclosure vulnerability
Missing Access Controls to Unauthenticated SQL injection SQLi / Email Address Disclosure vulnerability discovered by Tyler Miller in WordPress Contest Gallery plugin versions = 13.1.0.5. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.6...
WordPress Contest Gallery plugin <= 13.1.0.6 - Email Address Disclosure vulnerability
Email Address Disclosure vulnerability discovered by WPScanTeam in WordPress Contest Gallery plugin versions = 13.1.0.6. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 13.1.0.7...
Contest Gallery < 13.1.0.7 - Subscriber+ Email Address Disclosure
The plugin does not have any proper access controls when exporting users from a gallery, which could allow any authenticated users such as subscriber to list all users from the blog, disclosing their username and email address POST...
Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users...
WordPress Contest Gallery plugin <= 10.4.4 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Cryptography Laboratory in WordPress Contest Gallery plugin versions = 10.4.4. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 10.4.5...