CVE-2024-5442

Summary of CVE-2024-5442 (NextGEN Gallery) : The WordPress plugin NextGEN Gallery (versions before 3.59.3) contains sanitization/escaping flaws in settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., administrators) even when unfiltered_html is disallowed (such as in mult...

CVE-2024-3710

CVE-2024-3710 used details: The WordPress plugin “Image Photo Gallery Final Tiles Grid” (Final Tiles Grid Gallery Lite) is affected in versions before 3.6.0. The issue stems from insufficient validation/escaping of shortcode attributes, allowing Stored XSS when outputting attributes back into the...

PT-2024-36308 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered htm...

WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability

Authenticated Stored Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP Photo Album Plus versions = 8.8.02.002...

WordPress WP Photo Album Plus Plugin <= 8.8.02.002 is vulnerable to Cross Site Scripting (XSS)

Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.8.02.002 Fixed in 8.8.02.003 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38713 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5e63f89a72a3 Credits stealthcopter...

CVE-2024-37442

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1...

CVE-2024-37442

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1...

CVE-2024-37442 WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1...

CVE-2024-37442

CVE-2024-37442 concerns WordPress plugin Photo Gallery by Ays – Responsive Image Gallery . The cited issue is an HTML Injection vulnerability arising from improper neutralization of output elements used by a downstream component. Affected software is listed as Photo Gallery by Ays before version ...

CVE-2024-37442 WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1...

WordPress plugin Photo Gallery by Ays Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An injection vulnerability...

PT-2024-27556 · Ays · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by Ays versions prior to 5.7.1 Description: The issue is related to an Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as an 'Injection' vulnerability, in the Photo Gallery Team...

The vulnerabilities of the Handler for User Photo Upload Command and the Handler for Picture Upload Command in the microprogrammable biometric terminals ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME allow a perpetrator to gain unauthorized access, enabling them to read, modify, or delete data.

The vulnerability of the Handler for User Photo Upload Command and Handler for Picture Upload Command components of the microprogrammed software for biometric terminals ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME is related to errors in processing the relative path to the catalog...

WordPress Photo Gallery 1.8.26 Cross Site Scripting

Exploit Title: Wordpress Photo Gallery Version 1.8.26 Stored XSS Date: 2024-07-03 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://10web.io/plugins/wordpress-photo-gallery/ Version 1.8.26 Steps to Execute the Payload: 1. Click Photo Gallery Themes Edit Themes...

WordPress Photo Gallery by Ays plugin < 5.7.1 - HTML Injection vulnerability

HTML Injection vulnerability discovered by Ibnu Ubaeydillah Patchstack Alliance in WordPress Plugin Photo Gallery by Ays versions 5.7.1...

WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP Photo Album Plus versions = 8.8.00.002...

WordPress Photo Gallery by Ays Plugin < 5.7.1 is vulnerable to Content Injection

Software Photo Gallery by Ays Type Plugin Vulnerable versions 5.7.1 Fixed in 5.7.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-37442 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 76b249292f10 Credits Ibnu Ubaeydillah Required privilege...

WordPress WP Photo Album Plus Plugin <= 8.8.00.002 is vulnerable to Cross Site Scripting (XSS)

Software WP Photo Album Plus Type Plugin Vulnerable versions = 8.8.00.002 Fixed in 8.8.00.003 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37416 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b2c09f1a99da Credits stealthcopter...

CVE-2024-6373

A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The...

CVE-2024-6373

A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The...