PT-2026-103171

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

CVE-2026-102399: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...

PT-2026-103488

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

PT-2026-103172

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

PT-2026-103506

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

intigriti-0926-writeup

Intigriti Challenge 0926 — Critter Gallery: UNION-based SQL In...

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Responsive Slider Gallery versions = 1.5.5...

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...

intigriti-0926

Critter Gallery — SQL Injection Write-up Intigriti — Septem...

CVE-2026-97165

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-100749

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted...

CVE-2026-100748

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

CVE-2026-100747

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

EUVD-2026-87932

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

CVE-2026-100748

The Event Gallery extension for Joomla (by svenbluege.de ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in various cart actions. This issue affects versions less than 6.5.0 . While the specific root cause and remediation steps are not detailed in the provided documents, the vulnerabi...