10Web Photo Gallery vulnerabilities, page 3
49 vulnerabilities
Known vulnerabilities in 10Web Photo Gallery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-1611710webphoto_gallery+1
EPSS score4.61%
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-1611910webphoto_gallery+1EPSS score24.76%
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.CVE-2019-1611810webphoto_gallery+1EPSS score5.30%
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-1431310webphoto_gallery+1EPSS score4.48%
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.CVE-2019-1479810webphoto_gallery+1EPSS score4.43%
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.CVE-2019-1479710webphoto_gallery+1EPSS score1.29%
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.CVE-2023-142710webphoto_gallery+2EPSS score0.78%
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.CVE-2023-692410webphoto_gallery+2EPSS score0.46%
The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.CVE-2023-3399510webphoto_gallery+2EPSS score0.51%
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.