Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
10webPhoto Gallery*

18 matches found

CVE
CVE•added 2024/02/05 10:15 p.m.•70 views

CVE-2024-0221

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead t...

9.1CVSS7.3AI score0.01159EPSS
CVE
CVE•added 2024/01/11 9:15 a.m.•67 views

CVE-2023-6924

The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administr...

4.8CVSS4.8AI score0.00192EPSS
CVE
CVE•added 2024/03/26 4:15 p.m.•63 views

CVE-2024-29809

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The a...

5.4CVSS5.8AI score0.00062EPSS
CVE
CVE•added 2024/04/18 10:15 a.m.•60 views

CVE-2024-32583

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflected XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.21.

7.1CVSS6.8AI score0.0011EPSS
CVE
CVE•added 2024/04/06 9:15 a.m.•59 views

CVE-2024-2296

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

5.5CVSS5.6AI score0.00098EPSS
CVE
CVE•added 2024/04/29 1:15 p.m.•58 views

CVE-2024-33586

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.

5.3CVSS6.8AI score0.00158EPSS
CVE
CVE•added 2024/03/26 4:15 p.m.•55 views

CVE-2024-29832

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No a...

6.1CVSS6.7AI score0.00097EPSS
CVE
CVE•added 2024/03/26 4:15 p.m.•54 views

CVE-2024-29808

The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The att...

5.4CVSS5.8AI score0.00062EPSS
CVE
CVE•added 2024/03/26 4:15 p.m.•52 views

CVE-2024-29810

The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The a...

5.4CVSS5.8AI score0.00062EPSS
CVE
CVE•added 2024/03/26 4:15 p.m.•51 views

CVE-2024-29833

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an...

5.4CVSS5.3AI score0.00037EPSS
CVE
CVE•added 2024/06/07 10:15 a.m.•50 views

CVE-2024-5426

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta...

6.4CVSS5.5AI score0.0026EPSS
CVE
CVE•added 2024/06/11 3:16 p.m.•49 views

CVE-2024-35628

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.

4.3CVSS5AI score0.00159EPSS
CVE
CVE•added 2024/11/29 6:15 a.m.•46 views

CVE-2024-10704

The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

4.8CVSS5.4AI score0.00038EPSS
CVE
CVE•added 2024/06/07 10:15 a.m.•44 views

CVE-2024-5481

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the se...

8.8CVSS7.4AI score0.01184EPSS
CVE
CVE•added 2024/10/06 12:15 p.m.•39 views

CVE-2024-44043

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.27.

5.9CVSS6.1AI score0.00057EPSS
CVE
CVE•added 2024/10/09 6:15 a.m.•39 views

CVE-2024-5968

The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in mu...

4.8CVSS4.7AI score0.00068EPSS
CVE
CVE•added 2024/12/13 3:15 p.m.•35 views

CVE-2023-33995

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.

4.3CVSS4.7AI score0.00085EPSS
CVE
CVE•added 2024/11/05 10:21 a.m.•32 views

CVE-2024-9878

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

4.8CVSS4.4AI score0.0007EPSS