700 matches found
WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion vulnerability
Authenticated Arbitrary Gallery Image Deletion vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 4.5.0...
CVE-2026-81653 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...
CVE-2026-81653
The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin versions before 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that a user owns the gallery associated with a specific image. Consequently, users granted g...
CVE-2026-81654
The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authorization bypass because it fails to verify if a user possesses the options capability before saving image sizing settings. This allows users with only gallery-management privileges to modify settings that affec...
CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...
CVE-2026-81652 NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...
CVE-2026-81650 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...
CVE-2026-81650 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...
WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Cross-Gallery Settings Modification vulnerability
Authenticated Cross-Gallery Settings Modification vulnerability discovered by Murad Akhmedov in WordPress Plugin NextGEN Gallery versions 4.5.0...
CVE-2026-81652
The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin before version 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user is entitled to a specific image record before returning it. This allows us...
CVE-2026-81651
The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authenticated cross-gallery settings modification due to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify gallery ownership when a user saves settings, allowing any user with gallery-manag...
CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...
CVE-2026-81652 NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...
NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)
According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...
CVE-2026-82583
NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...
CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command
NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...
NextGen Healthcare Mirth Connect
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize...
CVE-2026-28141
Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...