CVE-2026-81654

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Plugin Image Settings Update vulnerability

Authenticated Plugin Image Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 4.5.0...

EUVD-2026-83666

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81653 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

CVE-2026-81654 NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81653

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin versions before 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that a user owns the gallery associated with a specific image. Consequently, users granted g...

CVE-2026-81654

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authorization bypass because it fails to verify if a user possesses the options capability before saving image sizing settings. This allows users with only gallery-management privileges to modify settings that affec...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion vulnerability

Authenticated Arbitrary Gallery Image Deletion vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-81653 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

EUVD-2026-83665

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

CVE-2026-81654 NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Contributor+ Image Metadata Disclosure vulnerability

Contributor+ Image Metadata Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-94041: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

PT-2026-95983

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the item, price, image, or type arguments within the 'admin/add...

CVE-2026-81654: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

PT-2026-95919

Name of the Vulnerable Software and Affected Versions Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if a user possesses the required options capability before saving image sizing settings. This allows users who have only been...

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

PT-2026-95739

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.09.003 Description Authenticated users with subscriber-level access and above can achieve Remote Code Execution via the wppa image magick function. The issue stems from insufficient sanitization of the...

CVE-2026-81180 SysReptor: Authenticated RCE by insecure image processing

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...