CVE-2026-5347: Missing Authorization

The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admininit hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php...

PT-2026-24976

Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the gallery id parameter. Attackers can send GET requests to gallery.php with malicious gallery id values using...

CVE-2019-25516: Improper Neutralization of Special Elements used in an SQL Command

Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the galleryid parameter. Attackers can send GET requests to gallery.php with malicious galleryid values using...

EUVD-2008-4718

Malware in sbrugna...

EUVD-2007-1121

Malware in sbrugna...

EUVD-2012-6379

Malware in sbrugna...

EUVD-2007-0500

Malware in sbrugna...

EUVD-2010-2143

Malware in sbrugna...

EUVD-2007-1544

Malware in sbrugna...

EUVD-2012-5212

Malware in sbrugna...

EUVD-2011-0539

Malware in sbrugna...

CVE-2025-0722: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in needyamin imagegallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. T...

CVE-2022-4164: Undefined Security Weakness

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cgmultiplefilesforpost POST parameter before concatenating it to an SQL query in 0change-gallery.php. This may allow malicious users with at least author privilege to leak...

CVE-2022-4159: Undefined Security Weakness

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cgid POST parameter before concatenating it to an SQL query in 0change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive...

CVE-2021-39313: Improper Neutralization of Input During Web Page Generation

The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

PT-2021-22522

Name of the Vulnerable Software and Affected Versions: Simple Image Gallery WordPress plugin versions up to and including 1.0.6 Description: The issue allows attackers to inject arbitrary web scripts via the msg parameter found in the /simple-image-gallery.php file, enabling Reflected Cross-Site...

PT-2020-16917

Name of the Vulnerable Software and Affected Versions SourceCodester Alumni Management System version 1.0 Description The issue concerns cross-site scripting XSS in the /admin/gallery.php endpoint. After admin authentication, an attacker can upload an image to the gallery using a XSS payload in t...

PT-2020-16918

Name of the Vulnerable Software and Affected Versions DourceCodester Alumni Management System version 1.0 Description A Remote Code Execution issue exists, allowing an authenticated attacker to upload arbitrary files in the "gallery.php" page and execute them on the server. This enables the...

CVE-2020-28072: Unrestricted Upload of File with Dangerous Type

A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...

CVE-2020-10225: Unrestricted Upload of File with Dangerous Type

An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to the server, including PHP files, which could result in command execution...