Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to Reflected Cross-Site Scripting XSS issues via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action available to both unauthenticated and authenticated users...

VulnCheck KEV: CVE-2020-11732

The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mlagallery link=download...

CVE-2021-25379

Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action...

CVE-2021-25379

Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action...

Information disclosure

Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action...

CVE-2021-25379

Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action...

CVE-2021-25379

Samsung Gallery (Android) prior to version 5.4.16.1 is affected by an intent-redirection elevation-of-privilege vulnerability. The issue allows an attacker to trigger privileged actions within the app. Public sources consistently describe the flaw as an elevation of privilege via intent redirecti...

CVE-2021-25379

Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action...

Samsung Gallery 安全漏洞

Samsung Gallery is an application from Samsung South Korea. The best image and video viewing application for Galaxy users. An elevation of privilege vulnerability exists in Gallery versions prior to 5.4.16.1, which can be exploited by an attacker to perform privileged operations...

Composr CMS 10.0.36 Cross Site Scripting

Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting Date: 04/06/2021 Exploit Author: Orion Hridoy Vendor Homepage: https://compo.sr/ Software Link: https://compo.sr/download.htm Version: 10.0.36 Tested on: Windows/Linux CVE : CVE-2021-30150 Vulnerable Endpoint:...

MapifyLite < 4.0.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise the Image URL either in the settings or in a location, allowing editor+ users to use a malicious payload, leading to Stored Cross-Site Scripting issues. Notes WPScanTeam: - The vendor has been notified on March 24th, 2021 - The pro version is very likely to be...

WordPress Photo Gallery Plugin < 1.5.55 SQLi Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Envira Photo Gallery Plugin < 1.8.3.3 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:enviragallery:enviragallery"; ifdescription...

CVE-2021-24139

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...

CVE-2021-24139

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...

CVE-2021-24126

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

CVE-2021-24126

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

Privilege escalation

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

CVE-2021-24126

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

Sql injection

Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...