9 matches found
CVE-2024-5424: Improper Neutralization of Input During Web Page Generation
The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...
CVE-2015-9446
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9446: Improper Neutralization of Special Elements used in an SQL Command
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9447: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
TikiWiki Project 1.8 tiki-upload_file.php galleryId Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10100/info Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting,...
CVE-2008-6988: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Easy Photo Gallery aka Ezphotogallery 2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 galleryid parameter to gallery.php, and the 2 size or 3 imageid parameters to show.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...
CVE-2007-6309: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the galleryID parameter in a usergallery upload action; or the 2 upID, 3 tag, 4 month, 5 userID, or 6 year parameter in a calendar announce action...
CVE-2007-0492: Undefined Security Weakness
Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 galleryID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...