Coppermine Photo Gallery vulnerabilities, page 2
34 vulnerabilities
Known vulnerabilities in Coppermine Photo Gallery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2004-1985coppermine · coppermine_photo_gallery +1 morecoppermine coppermine_photo_galleryCross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL parameter.EPSS3.91%MediumCVE-2004-1986coppermine · coppermine_photo_gallery +1 morecoppermine coppermine_photo_galleryDirectory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to read arbitrary files via a .. (dot dot) in the startdir parameter.EPSS10.63%HighCVE-2004-1988coppermine · coppermine_photo_gallery +1 morecoppermine coppermine_photo_galleryPHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to reference a URL on a remote web server that contains functions.inc.php.EPSS9.33%HighCVE-2004-1987coppermine · coppermine_photo_gallery +1 morecoppermine coppermine_photo_gallerypicmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG['impath'] or (2) $CONFIG['jpeg_qual'] parameters.EPSS10.20%MediumCVE-2009-1616coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryCross-site scripting (XSS) vulnerability in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via the css parameter, a different vector than CVE-2008-0505.EPSS1.65%HighCVE-2006-2976coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryUnspecified vulnerability in usermgr.php in Coppermine Photo Gallery before 1.4.7 has unknown impact and remote attack vectors, possibly related to authorization/authentication errors.EPSS1.41%HighCVE-2006-2514coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryCoppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.EPSS1.55%MediumCVE-2006-1909coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryDirectory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.EPSS3.71%MediumCVE-2006-0872coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryDirectory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.EPSS2.36%MediumCVE-2006-0873coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryAbsolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames.EPSS1.70%HighCVE-2006-4321coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryPHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS3.25%HighCVE-2006-5622coppermine · coppermine_photo_gallerycoppermine coppermine_photo_gallerySQL injection vulnerability in picmgr.php in Coppermine Photo Gallery 1.4.9 allows remote attackers to execute arbitrary SQL commands via the aid parameter.EPSS1.18%LowCVE-2006-6123coppermine · coppermine_photo_gallerycoppermine coppermine_photo_galleryCoppermine Photo Gallery (CPG) 1.4.8 stable, with register_globals enabled, allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space, with separate _GET, _REQUEST, or other critical parameters, which are unset by the protection scheme and prevent the original variable from being detected.EPSS1.35%HighCVE-2006-3064coppermine · coppermine_photo_gallerycoppermine coppermine_photo_gallerySQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.EPSS1.30%