CVE-2023-0938

CVE-2023-0938 affects SourceCodester Music Gallery Site 1.0, specifically the GET Request Handler’s music_list.php. The vulnerability arises from unsafely handling the URL parameter cid , allowing remote SQL injection. Public exploits exist (e.g., Exploit-DB), indicating practical exploitability....

PT-2023-16625 · Unknown · Sourcecodester Music Gallery Site

Name of the Vulnerable Software and Affected Versions: SourceCodester Music Gallery Site version 1.0 Description: A critical issue has been discovered, affecting the GET Request Handler component in the music list.php file. The manipulation of the cid argument leads to SQL injection, allowing for...

Music Gallery Site SQL注入漏洞

Music Gallery Site is a music gallery site by the individual developer Carlo Montero. A SQL injection vulnerability exists in Music Gallery Site version 1.0, which stems from an incorrect manipulation of the parameter cid resulting in sql injection...

Video Gallery < 1.7.7 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Circles Gallery <= 1.0.10 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Video Gallery – YouTube Gallery Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25979 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bf4c411df4a1 Credits yuyudhn...

WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Books Gallery Type Plugin Vulnerable versions = 4.4.8 Fixed in 4.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23705 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db5a6b5005b4 Credits yuyudhn Required...

WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Broken Access Control

Software Video Gallery – YouTube Gallery Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25988 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 1684686ddd67 Credits István Márt...

WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Software Circles Gallery Type Plugin Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23881 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 80742a31d5c5 Credits Rio Darmawan Required...

SUSE CVE-2020-8119

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app...

ryeartgallery.co.uk Cross Site Scripting vulnerability OBB-3194007

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

NextGEN Gallery < 3.29 - Thumbnail Deletion via CSRF

The plugin does not have CSRF checks when deleting Thumbnail, which could allow attackers to make logged in users with the editPost capability to perform such action via a CSRF attack...

WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.28 Fixed in 3.29 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-38468 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fe370d77a56e Credits István Márton Require...

CVE-2023-0151

The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4783

The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2022-4682

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4682

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

Cross site scripting

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4682 Lightbox Gallery < 0.9.5 - Contributor+ Stored XSS via Shortcode

The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...