PT-2015-5250

Name of the Vulnerable Software and Affected Versions Pixabay Images plugin versions prior to 2.4 Description The issue concerns the Pixabay Images plugin for WordPress, where the pixabay-images.php file does not properly restrict access to the upload functionality. This allows remote attackers t...

PT-2015-5240

Name of the Vulnerable Software and Affected Versions Pixabay Images plugin versions prior to 2.4 Description The issue allows remote attackers to write to arbitrary files via a .. dot dot in the q parameter. This is a directory traversal vulnerability in the pixabay-images.php file...

PT-2015-5251

Name of the Vulnerable Software and Affected Versions Pixabay Images plugin versions prior to 2.4 Description The issue concerns the Pixabay Images plugin for WordPress, where the pixabay-images.php file does not validate hostnames. This allows remote authenticated users to write to arbitrary fil...

PT-2014-5100

Name of the Vulnerable Software and Affected Versions NextCellent Gallery plugin versions prior to 1.19.18 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users with specific permissions to inject arbitrary web script or...

CVE-2014-3123: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or...

CVE-2013-5962

The CVE-2013-5962 entry relates to the WordPress plugin Complete Gallery Manager (before 3.3.4 rev40279). Affected component: frames/upload-images.php which permits an unrestricted file upload. Root cause: uploading a file with an executable extension allows remote attackers to access the uploade...

PT-2013-5886

Name of the Vulnerable Software and Affected Versions Complete Gallery Manager plugin versions prior to 3.3.4 rev40279 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the /frames/upload-images.php endpoint, and then...

CVE-2013-5962: Undefined Security Weakness

Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-5450: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-6064: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

PT-2011-4694

Name of the Vulnerable Software and Affected Versions SweetRice version 0.7.1 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by accessing plugin/tiny mce/plugins/advimage/images.php, which reveals the...

CVE-2011-3804: Exposure of Sensitive Information to an Unauthorized Actor

SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugin/tinymce/plugins/advimage/images.php...

CVE-2010-3418

Multiple cross-site scripting XSS vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 carid parameter to index.php and 2 y parameter to include/images.php...

CVE-2010-3418: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 carid parameter to index.php and 2 y parameter to include/images.php...

CVE-2009-4252

CVE-2009-4252 is an XSS vulnerability in the Clixint DPI Image Hosting Script DPI 1.1 Final (1.1F). The issue affects images.php and allows remote attackers to inject arbitrary web script or HTML via the date parameter. Several connected sources corroborate this: OpenVAS NASL entries describe a p...

CVE-2009-4252: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in images.php in Image Hosting Script DPI 1.1 Final 1.1F allows remote attackers to inject arbitrary web script or HTML via the date parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-6768: Undefined Security Weakness

Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/upload/...

CVE-2008-5794: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete arbitrary files via a .. dot dot in the delete parameter...

LoveCMS 1.6.2 Final Arbitrary File Delete Vulnerability

Exploit for unknown platform in category web applications ======================================================= LoveCMS 1.6.2 Final Arbitrary File Delete Vulnerability =======================================================...