Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

CVE-2026-82985

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

EUVD-2026-82622

The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...

CVE-2026-82985

CVE-2026-82985 affects the Photos app 's filter-based smart albums . The root cause is that when a smart album is shared, the file listing is built using the viewer's photosSourceFolders search configuration rather than the album owner's configuration. This allows a user viewing a shared smart al...

ms-photos_NTLM_Leak

Fuga de NTLM mediante URI ms-photos de Microsoft Nueva vulnerabilidad que permite filtrar hashes NTLM desde navegadores con un solo clic Por Ruben Enkaoua Descripción El esquema URI ms-photos de Microsoft toma fileName como parámetro, el cual puede ser enviado con una ruta UNC, filtrando hashes...

WhatsApp-OSINT

WHATS OSINT 🕵️‍♂️ WhatsApp 开源情报工具 ，允许你获取个人资料照片、验证企业账户、检查状态和用户信息、分析关联设备、查看隐私设置，并通过 RapidAPI 上的 WhatsApp OSINT API 访问完整数据。 支持 6 个端点： about, base64, business, devices, doublecheck, privacy 。 🚀 功能特性 通过电话号码获取 WhatsApp 个人资料照片 验证 WhatsApp 企业账户 检查用户状态和基本信息 分析关联设备 获取完整的 OSINT 信息 查看隐私设置 自动验证电话号码格式...

CVE-2026-72550-poc

CVE-2026-72550 — Inyección SQL no autenticada en Friendica La inyección SQL de consultas apiladas no autenticada en el endpoint de fotos de Friendica permite que cualquier visitante ejecute SQL arbitrario...

CVE-2024-6132

CVE-2024-6132 Pexels: Fotos de stock gratuitas = 1.2.2 - Carga arbitraria de archivos autenticada Contribuidor+ Uso root@kitploit: usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | B...

WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability

Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-14290 Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

EUVD-2026-58595

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-14290

CVE-2026-14290 concerns the WordPress plugin “Embed Google Photos album” (versions

CVE-2026-14290

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including...

CVE-2026-15236

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

EUVD-2026-51953

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

CVE-2026-15236 Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...

CVE-2026-15236

The CVE-2026-15236 affects the Gallery for Google Photos WordPress plugin: versions before 1.2.1 do not properly restrict access to stored third‑party OAuth credentials, exposing persistent access and refresh tokens to unauthenticated users and enabling long‑term compromise of the linked account....

CVE-2026-64745

This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical access to a locked device may be able to access contacts and photos...