CVE-2022-1282 Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $GET'imageurl' variable, which is reflected back to the users when executing the editimagebwg AJAX action...

CVE-2022-1281

The CVE-2022-1281 issue affects the WordPress Photo Gallery plugin up to version 1.6.3, where the $_POST['filter_tag'] parameter is not properly escaped before being appended to an SQL query, enabling SQL Injection attacks. Multiple connected advisories confirm the root cause and impact as unauth...

CVE-2022-1281 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $POST'filtertag' parameter, which is appended to an SQL query, making SQL Injection attacks possible...

WordPress plugin Photo Gallery SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A SQL injection vulnerability exists in versions prior to WordPress Photo Gallery plugin 1.6.3, which stems...

WordPress plugin Photo Gallery by 10Web 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Photo Gallery by 10Web plugin is vulnerable to a cross-site scripting vulnerability that stems from...

WordPress Gmedia Photo Gallery plugin <= 1.19.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kaushalendra Dubey in WordPress Gmedia Photo Gallery plugin versions = 1.19.7. Solution Update the WordPress Gmedia Photo Gallery plugin to the latest available version at least 1.20.0...

Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed https://youtu.be/kTMg65teTvU Create ...

Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed PoC https://youtu.be/kTMg65teTvU...

event.animalphotocompetition.com Cross Site Scripting vulnerability OBB-2542690

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Recover Deleted Photos from PC and Mobile

By Owais Sultan Suppose many of you have deleted or erased images by accident. It may happen on a computer, be… This is a post from HackRead.com Read the original post: Recover Deleted Photos from PC and Mobile...

Photo Gallery < 1.6.3 - Unauthenticated SQL Injection

The plugin does not properly escape the $POST'filtertag' parameter, which is appended to an SQL query, making SQL Injection attacks possible. POST /wp-admin/admin-ajax.php?imageid=123 HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: zh,en;q=0.5 Accept-Encoding: gzip,...

WordPress Photo Gallery plugin <= 1.6.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Photo Gallery plugin versions = 1.6.2. Solution Update the WordPress Photo Gallery plugin to the latest available version at least 1.6.3...

WordPress Photo Gallery by 10Web plugin <= 1.6.2 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Photo Gallery by 10Web plugin versions = 1.6.2. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.6.3...

Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting

The plugin does not properly sanitize the $GET'imageurl' variable, which is reflected back to the users when executing the editimagebwg AJAX action. var form1 = document.getElementById'hack'; form1.submit;...

Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting

The plugin does not properly sanitize the $GET'imageurl' variable, which is reflected back to the users when executing the editimagebwg AJAX action. PoC...

online-photo-directory.com Cross Site Scripting vulnerability OBB-2480789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Europe Is Building a Huge International Facial Recognition System

Lawmakers advance proposals to let police forces across the EU link their photo databases—which include millions of pictures of people’s faces...

WordPress Photo Gallery Plugin < 1.5.68 XSS Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Photo Gallery Plugin < 1.6.0 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

ImpressCMS path traversal vulnerability

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a path traversal vulnerability that can be exploited by an authenticated attacker to delete arbitrary files on the system by...