The vulnerability of the Envira Photo Gallery plugin of the WordPress content management system, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Envira Photo Gallery plugin of the WordPress content management system exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

WordPress Photo Gallery Plugin SQL Injection (CVE-2022-0169)

A SQL injection vulnerability exists in the WordPress Photo Gallery plugin. This vulnerability is due to an input validation error on the bwgtagidbwgthumbnails0 parameter...

Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting

The plugin does not escape generated URLs before outputting them back in attributes, leading to a Reflected Cross-Site Scripting. PS: The original advisory mentions the issue being in photo-gallery, however it is not the case. On a page where there is a gallery embed, append a'-alert/XSS///=1 e.g...

Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting

The plugin does not escape generated URLs before outputting them back in attributes, leading to a Reflected Cross-Site Scripting. PS: The original advisory mentions the issue being in photo-gallery, however it is not the case. PoC On a page where there is a gallery embed, append a'-alert/XSS///=1...

WordPress Photo Gallery 1.8.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

CVE-2022-39103

In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges needed...

CVE-2022-39103

In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges needed...

Denial of service

In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges needed...

CVE-2022-39103

The CVE-2022-39103 entry concerns the Gallery service, where a missing permission check is the root cause. This vulnerability could permit local denial of service without requiring additional execution privileges. Publicly provided documents reiterate the issue but do not specify affected version...

PT-2022-24729 · Unknown · Gallery Service

Name of the Vulnerable Software and Affected Versions: Gallery service affected versions not specified Description: The issue is related to a missing permission check in the Gallery service, which could lead to a local denial of service. This can be achieved without requiring additional execution...

UNISOC chipset 安全漏洞

UNISOC chipset is an integrated circuit chipset from China's Unisoc Corporation. A security vulnerability exists in UNISOC chipset due to a lack of privilege checking in the gallery service, which could be exploited by an attacker to cause a local denial of service, and the following products and...

CVE-2022-39103

In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges needed...

CVE-2022-39103

In Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional execution privileges needed...

upstreamgallery.nl Cross Site Scripting vulnerability OBB-2991262

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-2823

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallow...

CVE-2022-2823

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallow...

CVE-2022-2823

The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallow...

WordPress Envira Gallery Lite plugin <= 1.8.4.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress Envira Gallery Lite plugin versions = 1.8.4.6. Solution Update the WordPress Envira Photo Gallery plugin to the latest available version at least 1.8.4.7...

WordPress plugin Slider, Gallery, and Carousel by MetaSlider 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers https://example.com/wp-admin/edit.php?posttype=envira&page=envira-gallery-lite-addons&"alert1...