CVE-2006-5505

CVE-2006-5505 describes multiple PHP file inclusion vulnerabilities in 2BGal 3.0 that allow remote attackers to execute arbitrary PHP code via the lang parameter to several admin scripts (admin/configuration.inc.php, admin/creer_album.inc.php, admin/changepwd.php.inc, and other files). The underl...

CVE-2007-1852

CVE-2007-1852 affects 2BGal 3.1.1 with multiple PHP remote file inclusion vulnerabilities exposed via the URL parameter (lang_filename) to admin/index.php or admin/backupdb.inc.php (and other files). Root cause notes that lang_filename is defined before use, a detail disputed by CVE. Connected PT...

CVE-2004-1415

CVE-2004-1415 – 2BGal SQL Injection affects 2BGal photo gallery (versions 2.4 and 2.5.1) via the PHP script modules, notably disp_album.php (and possibly disp_img.php). The root cause is failure to sanitize the id_album parameter, allowing remote attackers to inject arbitrary SQL commands. Conseq...