11790 matches found
CVE-2020-28071
SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting XSS in /admin/gallery.php. After the admin authentication an attacker can upload an image in the gallery using a XSS payload in the description textarea called 'about' and reach a stored XSS...
CVE-2020-28071
SourceCodester Alumni Management System 1.0 is affected by a Stored Cross-Site Scripting (XSS) in /admin/gallery.php. After admin authentication, an attacker can supply an XSS payload in the description field named “about” when uploading a gallery image, triggering stored XSS that can affect both...
Artworks Gallery Management System 1.0 - 'id' SQL Injection
Exploit Title: Artworks Gallery Management System 1.0 - 'id' SQL Injection Exploit Author: Vijay Sachdeva Date: 2020-12-22 Vendor Homepage: https://www.sourcecodester.com/php/14634/artworks-gallery-management-system-php-full-source-code.html Software Link:...
Artworks Gallery Management System 1.0 SQL Injection
Exploit Title: Artworks Gallery Management System 1.0 - 'id' SQL Injection Exploit Author: Vijay Sachdeva Date: 2020-12-22 Vendor Homepage: https://www.sourcecodester.com/php/14634/artworks-gallery-management-system-php-full-source-code.html Software Link:...
Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
The plugin does not properly sanitise the images metadata namely title before outputting them in the generated gallery. This allows privileged accounts such as editor+ to perform XSS attacks even without the unfilteredhtml capability against users visiting the gallery in the frontend. As an...
WordPress Envira Photo Gallery plugin <= 1.8.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Minh Tuan SunCSR in WordPress Envira Photo Gallery plugin versions = 1.8.3.2. Solution Update the WordPress Envira Photo Gallery plugin to the latest available version at least 1.8.3.3...
Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
The plugin does not properly sanitise the images metadata namely title before outputting them in the generated gallery. This allows privileged accounts such as editor+ to perform XSS attacks even without the unfilteredhtml capability against users visiting the gallery in the frontend. PoC As an...
CVE-2020-28072
A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...
Remote code execution
A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...
DourceCodester Alumni Management System 代码问题漏洞
Sourcecodester Alumni Management System is a Php, Mysql based alumni management system from Sourcecodester, Inc. A remote code execution vulnerability exists in the SourceCodester Alumni Management System version 1.0, which can be exploited by an authenticated attacker to upload an arbitrary file...
VulnCheck KEV: CVE-2018-11511
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'albumid' or 'scope' parameter via a photo-gallery/api/album/treelists/ URI...
Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Add Artwork
Exploit Title: Artworks Gallery 1.0 - Arbitrary File Upload RCE Authenticated Date: November 17th, 2020 Exploit Author: Shahrukh Iqbal Mirza @shahrukhiqbal24 Vendor Homepage: Source Code & Projects https://code-projects.org Software Link:...
WordPress NextGEN Gallery Plugin Cross-Site Scripting (CVE-2010-1186)
A script injection vulnerability exists in Alex rabe nextgen gallery 0.33. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...
WordPress Social Photo Gallery Plugin Remote Code Execution (CVE-2019-14467)
A remote code execution vulnerability exists in WordPress Social Photo Gallery Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
CVE-2020-28687
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files...
CVE-2020-28687
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files...
CVE-2020-28688
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files...
CVE-2020-28688
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files...