246 matches found
EUVD-2026-83666
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...
CVE-2026-81653 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...
CVE-2026-78085
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...
CVE-2026-78084
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
EUVD-2026-75389
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...
CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...
CVE-2026-78084
SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...
CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
EUVD-2026-75392
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...
WordPress Meta-box GalleryMeta plugin <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management vulnerability
Missing Authorization to Authenticated Author+ Gallery Management vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin Meta-box GalleryMeta versions = 3.0.1...
WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Gallery Management vulnerability discovered by WordFence in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.9...
CVE-2025-14455
CVE-2025-14455 affects Image Photo Gallery Final Tiles Grid for WordPress. Public details in Wordfence report show an authenticated-by-design authorization bypass (Contributor+ and above) for gallery management actions, enabling deletion/modification/cloning of any user galleries. A fix exists in...
CVE-2025-14455 Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible fo...
WordPress plugin Image Photo Gallery Final Tiles Grid 安全漏洞
...
PT-2025-48649
The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'process bulk action' function. This makes it possible for unauthenticated...
EUVD-2025-7307
Malicious code in bioql PyPI...
EUVD-2025-13389
Malicious code in bioql PyPI...