CVE-2024-55981

CVE-2024-55981 Nabz Image Gallery = v1.00 - Inyección SQL No Autenticada Descripción El plugin Nabz Image Gallery para WordPress es vulnerable a Inyección SQL en versiones hasta la v1.00 inclusive, debido a un escape insuficiente del parámetro proporcionado por el usuario y a la falta de...

CVE-2025-69460

CVE-2025-69460 – Simple Image Gallery 1.0 Ejecución Remota de Código RCE No Autenticado WriteUp CVE-2025-69460 – ExploitDB 50214...

ThingsBoard-IoT-Platform-CVE-2024-55466

Escalada de privilegios en ThingsBoard mediante XSS almacenado Mientras experimentaba con tecnología IoT, encontré una vulnerabilidad en la aplicación Thingsboard que permitía vías para la escalada de privilegios. Thingsboard es una aplicación de código abierto que permite la gestión de...

CVE-2026-88854

CVE-2026-88854 — Inyección SQL en OrdaSoft Joomla Gallery Escáner/exploit PoC en Python 3 para CVE-2026-88854 en OrdaSoft OS Responsive Image Gallery para Joomla. | ---|--- Componente| comosgallery, comosgallerylight Afectados| 1.0.0 – 6.2.6 Corregido en| 6.2.7+ CVSS 4.0| 9.3 Crítico Autenticació...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) vulnerability

Missing Authorization to Authenticated Author+ Arbitrary File Deletion Non-PHP vulnerability discovered by pbsec in WordPress Plugin Modula Image Gallery versions = 3.0.2...

CVE-2026-92713

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to and including 3.0.1 . The root cause is located in the Modula_Meta::add_metas() function, which is hooked to wp_head and fetches posts ...

EUVD-2026-86602

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

CVE-2026-92713 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-92713 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-92713

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 3.0.2 . The root cause is insufficient file path validation within the upload_image function, specifically failing to adequately restrict access via the file parameter. An au...

EUVD-2026-86592

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability

Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...

Exploit for CVE-2026-88854

CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python...

CVE-2026-15758: Exposure of Sensitive Information to an Unauthorized Actor

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...