WordPress Photo Gallery by 10Web plugin <= 1.5.30 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Tin Duong in WordPress Photo Gallery by 10Web plugin versions = 1.5.30. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.5.31...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

Design/Logic Flaw

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue arises from how user parameters are filtered before passing them into the phpthumb class, enabling an attack via a web request to /assets/components/gallery/connector.php to create fi...

MODX Revolution Gallery Code Issue Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from MODX Corporation in the United States. The system supports online collaboration, search engine optimization SEO, etc. MODX Revolution Gallery is a dynamic add-on library to MODX Revolution that sorts images and displays...

WordPress Contest Gallery plugin <= 10.4.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Cryptography Laboratory in WordPress Contest Gallery plugin versions = 10.4.4. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 10.4.5...

WordPress Gallery Photoblocks plugin <= 1.1.42 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress Gallery Photoblocks plugin versions = 1.1.42. Solution Update the WordPress Gallery Photoblocks plugin to the latest available version at least 1.1.43...

Azure Automation Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Azure Automation “RunAs account” runbooks for users with contributor role. This vulnerability could potentially allow members of an organization to access Key Vault secrets through a runbook, even if these members would personally not have access ...

Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS

The Gallery PhotoBlocks WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. PoC When logged in with an account with administrator capabilities: https:///wp-admin/admin.php?page=photoblocks-edit="...

Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS

The Gallery PhotoBlocks WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. When logged in with an account with administrator capabilities: https:///wp-admin/admin.php?page=photoblocks-edit&id="...

Feed Them Gallery <= 1.1.8 - XSS

Changelog for 1.1.9 mentions "Security Refactor of the whole plugin to stop XSS injections and other possibly malicious attempts to hack through the plugin."...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5974

The CVE-2019-5974 entry describes a Cross-site request forgery (CSRF) vulnerability in the WordPress Contest Gallery plugin, affecting versions prior to 10.4.5. According to the connected sources, an attacker could hijack the administrator’s authenticated session via unspecified vectors when a lo...

CVE-2019-5974

Cross-site request forgery CSRF vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Gallery Photoblocks < 1.1.41 - Unauthenticated Reflected XSS

Also Full Path Disclosure depending on the configuration of the server PoC https:///wp-content/plugins/photoblocks-grid-gallery/admin/partials/photoblocks-edit.php?id="...

WordPress Gallery Photoblocks plugin <= 1.1.40 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Gallery Photoblocks plugin versions = 1.1.40. Solution Update the WordPress Gallery Photoblocks plugin to the latest available version at least 1.1.41...

Gallery Photoblocks < 1.1.41 - Unauthenticated Reflected XSS

Also Full Path Disclosure depending on the configuration of the server https:///wp-content/plugins/photoblocks-grid-gallery/admin/partials/photoblocks-edit.php?id="...