CVE-2022-0169

CVE-2022-0169 — WordPress Photo Gallery SQLi PoC これは、WordPress Photo GalleryプラグインのSQLインジェクション脆弱性であるCVE-2022-0169 のためのシンプルなPython proof-of-concept（PoC）です。 機能 WordPressのバージョンを確認（可能な場合） 脆弱なadmin-ajax.phpエンドポイントを悪用 wpusersのユーザー名とパスワードハッシュをダンプ タイムスタンプ付きのフォルダに結果を保存 必要に応じてhashcatでクラックするかどうかプロンプト表示...

Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion

Joomla! Omilen Photo Gallery comomphotogallery component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. id: CVE-2009-4202 info: name: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion...

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action, available to both unauthenticated and authenticated users. id: CVE-2021-2429...

Photo Gallery WordPress v1.6.3 - SQL Injection

Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $POST'filtertag' parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests. id: CVE-2022-1281 info: name: Photo Gallery WordPress v1.6.3 -...

Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.1.1 contain a cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-30194 info:...

Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...

WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure

Widgets for Social Photo Feed WordPress plugin = 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely. id: CVE-2025-14726 info: name: WordPress Widgets for Social Photo...

10Web Photo Gallery < 1.5.55 - SQL Injection

WordPress plugin 10Web Photo Gallery versions before 1.5.55 contains a SQL injection caused by unvalidated input in the 'bwgsearchx' parameter in frontend/models/model.php, letting attackers execute arbitrary SQL commands, exploit requires attacker to control the 'bwgsearchx' parameter. id:...

Joomla! Component Photo Battle 1.0.1 - Local File Inclusion

A directory traversal vulnerability in the Photo Battle comphotobattle component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php. id: CVE-2010-1461 info: name: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion author: daffainfo...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - 저장형 크로스 사이트 스크립팅 XSS 영향받는 버전: InstantCMS 2.16.3 재현 단계: 1. 데모 사용자로 https://demo.instantcms.io에 로그인합니다. 2. https://demo.instantcms.io/photos/upload를 방문합니다. 3. Camera Model Name 메타데이터 필드에 페이로드 테스트 가 포함된 이미지를 업로드합니다. 4. https://demo.instantcms.io/photos/camera-payload를...

CVE-2025-55816

CVE-2025-55816 CVE-2025-55816 HotelDruid 3.0.7 作成者: partywave 協力: Raptx team 外部参考文献 HotelDruid 3.0.8 変更履歴 CVE ブログ記事 Raptx サイト 脆弱性 この脆弱性は、/modificaapp.php エンドポイントにおける単純な Stored Cross Site Scripting XSS です。 攻撃者は、セキュリティ対策の欠如により、 'New Photo Url' 機能にURLを装ったjavascriptペイロードを挿入できます。 脆弱なコードは、HotelDruid ",...

chiasmodon

Chiasmodon Chiasmodon is an OSINT tool that allows users to gather information from various sources and conduct targeted searches based on domains, Google Play applications, email addresses, IP addresses, organizations, URLs, and more. It provides comprehensive scanning capabilities, customizable...

CVE-2022-40471

CVE-2022-40471 Clinic's Patient Management System v 1.0 の無制限ファイルアップロードの脆弱性によるリモートコード実行 技術的な説明: Clinic's Patient Management System v 1.0 のリモートコード実行により、攻撃者は users.php のプロフィール画像アップロード機能を介して任意の PHP ウェブシェルをアップロードできます。 影響を受けるコンポーネント - ソースコード...

vk-geosearch

vk-geosearch 소셜 네트워크vk.com에서 지오태그로 사진 검색 종속 항목 requests 설치 git clone https://github.com/yevgen2020/vk-geosearch.git pip3 install requests cd vk-geosearch chmod +x search.py 사용법 VK에서 사진을 검색하려면 서비스 액세스 키 또는 토큰이 필요합니다. Standalone 애플리케이션을 만드세요. 설정으로 이동하여 상태 필드에서 "애플리케이션이 활성화되어 있고 모든 사람에게 표시됨"으로 설정하세요...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.46 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by r3foxx in WordPress Plugin Photo Gallery by 10Web versions = 1.8.46...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ivaylo in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

CVE-2026-92974

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumburl' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91954

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumburl' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-92974

The Photo Gallery by 10Web WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.8.46 . The root cause is insufficient input sanitization and output escaping of the thumb_url parameter. An unauthenticated attacker can inject arbitrary web scr...

CVE-2026-92974 Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumburl' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for...