Authentication flaw

The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, iOS 16.5 and iPadOS 16.5. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication...

CVE-2023-32365

The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, iOS 16.5 and iPadOS 16.5. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication...

PT-2023-23751 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.7.6 iOS versions prior to 16.5 iPadOS versions prior to 15.7.6 iPadOS versions prior to 16.5 Description: The issue allows a deleted photo to be re-surfaced without authentication through the Shake-to-undo feature. Th...

CVE-2023-32365

The CVE-2023-32365 issue affects Apple iOS/iPadOS Photos via the Shake-to-undo feature, enabling a deleted photo to be surfaced without authentication. The root cause details in the sources indicate a logic/validation issue within the Photos handling that could expose previously deleted content. ...

Admidio 安全漏洞

Admidio is an open source member management system from the Admidio team. The system supports member lists, event management, guestbooks, photo albums and downloads. A security vulnerability exists in Admidio versions prior to 4.2.9 that stems from incorrect access control...

WordPress Photo Gallery by Ays Plugin < 5.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by Ays Type Plugin Vulnerable versions 5.1.7 Fixed in 5.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2568 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 1b5a7b5e5c1c Credits Erwan LR WPScan...

photo.cuboimages.it Cross Site Scripting vulnerability OBB-3447710

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Photo Gallery by 10Web Plugin <= 1.8.15 is vulnerable to Broken Access Control

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.15 Fixed in 1.8.16 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33995 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0293acc0bbe3 Credits Rafshanzani Suhada...

WordPress Photo Gallery Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Photo Gallery, which can be exploited by an attacker to execute script in a victim's web...

CVE-2023-30179

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection SSTI. An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrator...

Design/Logic Flaw

DISPUTED CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection SSTI. An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only...

CraftCMS 代码注入漏洞

CraftCMS is a content management system from CraftCMS, Inc. A code injection vulnerability exists in CraftCMS version 3.7.59, which stems from susceptibility to a server-side template injection SSTI attack, where an attacker can inject a Twig template into the er Photo Location field when the Use...

PT-2023-22567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS version 3.7.59 Description: The issue concerns Server-Side Template Injection SSTI, where an authenticated attacker can inject Twig Template into the User Photo Location field in User Settings, potentially leading to Remote Code...

CVE-2023-2568

The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2568

The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2568

CVE-2023-2568 concerns the WordPress plugin Photo Gallery by Ays . Vulnerable are versions prior to 5.1.7 . The issue arises because the plugin does not escape certain parameters when outputting them in HTML attributes, enabling a Reflected XSS flaw. The documented impact notes that this could be...

CVE-2023-2568 Photo Gallery by Ays < 5.1.7 - Reflected XSS

The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Plugin Photo Gallery by Ays 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-2402

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchterm parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-2402

CVE-2023-2402 refers to the WordPress plugin “Photo Gallery Slideshow & Masonry Tiled Gallery” (WP Responsive Photo Gallery). The vulnerability is a reflected Cross-Site Scripting (XSS) in the search_term parameter caused by insufficient input sanitization and output escaping, allowing unauthenti...