WordPress NextGEN Gallery 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.NextGEN Gallery is an image gallery plugin used in it. WordPress plugin NextGEN Gallery Pro before 3.1.11 version has a...

WordPress NextGEN Gallery Pro premium plugin <= 3.1.9 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Mg Thura Moe Myint in WordPress NextGEN Gallery Pro premium plugin versions = 3.1.9. Solution Update the WordPress NextGEN Gallery Pro premium plugin to the latest available version at least 3.1.11...

CVE-2021-0248

This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative interfaces. This issue affects: Junip...

WordPress NextGEN Gallery plugin cross-site request forgery vulnerability (CNVD-2021-13194)

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...

WordPress NextGEN Gallery Pro premium plugin <= 3.1.9 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Thura Moe Myint in WordPress NextGEN Gallery Pro premium plugin versions = 3.1.9. Solution Update the WordPress NextGEN Gallery Pro premium plugin to the latest available version at least 3.1.11...

NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)

In the eCommerce module of NextGEN Gallery Pro, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript. PoC On a page where a NextGEN Pro gallery is embed:...

NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)

In the eCommerce module of NextGEN Gallery Pro, there is an action to call getcartitems via photocratiajax , after that the settingsshippingaddressname is able to inject malicious javascript. On a page where a NextGEN Pro gallery is embed:...

WordPress NextGEN Gallery plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...

NextGEN Gallery Plugin for WordPress < 3.5.0 Cross-Site Request Forgery

The WordPress NextGEN Gallery Plugin installed on the remote host is affected by two Cross-Site Request Forgery CSRF vulnerabilities due to a logic flaw in the isauthorizedrequest function leading to Cross-Site Scripting XSS and remote code execution via file upload and local file inclusion. Note...

WordPress NextGEN Gallery Plugin < 3.5.0 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:imagely:nextgengallery"; if description...

CVE-2020-35943

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35943

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35942

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35943

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. It is possible to bypass CSRF protection by simply not including a nonce parameter...

CVE-2020-35943

CVE-2020-35943 affects the WordPress NextGEN Gallery plugin prior to version 3.5.0. A CSRF weakness in the plugin’s request handling (notably in security checks around nonce validation) could allow an attacker to upload arbitrary files via crafted requests, with potential for remote code executio...

CVE-2020-35942

The CVE concerns WordPress NextGEN Gallery plugin prior to version 3.5.0. A CSRF logic flaw in is_authorized_request (and related checks) could permit requests without a proper nonce, enabling actions via settings modification that allow file upload and local file inclusion, which could lead to r...

CVE-2020-35942

A Cross-Site Request Forgery CSRF issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. It is possible to bypass CSRF protection by simply not including a nonce parameter...

WordPress NextGEN Gallery plugin 跨站请求伪造漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...