CVE-2022-0873

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is...

CVE-2022-0873

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is...

Cross site scripting

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is...

CVE-2022-0873

The CVE-2022-0873 entry concerns the WordPress Gmedia Photo Gallery plugin prior to 1.20.0. The connected Nuclei template confirms a Cross-Site Scripting (XSS) vulnerability caused by failure to sanitize/escape the album name when output in pages or posts with a media embed. This could allow high...

WordPress plugin Gmedia Photo Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Gmedia Photo Gallerys plugin version 1.20.0 before version 1.20.0 has a cross-site scriptin...

PT-2022-13490

Name of the Vulnerable Software and Affected Versions Gmedia Photo Gallery WordPress plugin versions prior to 1.20.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the Album's name is not properly sanitised and...

WordPress Photo Gallery plugin <= 1.6.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by 0ppr2s in WordPress Photo Gallery plugin versions = 1.6.3. Solution Update the WordPress Photo Gallery plugin to the latest available version at least 1.6.4...

Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting

The plugin does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed PoC Go to Photo Gallery Global Settings Watermark Using the web browser inspector, change the input...

Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting

The plugin does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed Go to Photo Gallery Global Settings Watermark Using the web browser inspector, change the input typ...

photo-ac.com Cross Site Scripting vulnerability OBB-2617336

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Pagekit Stored Cross-site Scripting

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user...

Cross-site Scripting (XSS)

Overview modx/revolution is a Content Management System. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getProfilePhoto function in the core/model/modx/moduser.class.php file. An attacker can execute arbitrary scripts in the context of a user's browser sessio...

GHSA-Q4C2-Q63G-62J7 MODX Revolution vulnerable to XSS attack through its User Photo field

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

MODX Revolution vulnerable to XSS attack through its User Photo field

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

QNAP Photo Station Improper Authentication Vulnerability (QSA-22-15)

QNAP Photo Station is prone to an improper authentication vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

WordPress Photo Gallery by 10Web plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Photo Gallery by 10Web plugin is vulnerable to a cross-site scripting vulnerability that stems from...

CVE-2021-44057

An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station...

CVE-2021-44057

An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station...

Authentication flaw

An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station...

CVE-2021-44057

CVE-2021-44057 describes an improper authentication vulnerability in QNAP Photo Station. Connected sources confirm affected product: QNAP Photo Station on NAS devices, with root cause in authentication handling that allows system compromise. Remediation shown in connected documents includes fixes...