CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35780 – WordPress Galleria Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-35780
Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions. The Galleria plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the showOptionsPage function. This makes it possible for unauthenticated attackers to change the plugin theme via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/galleria/wordpress-galleria-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 27%CPEs: 1EXPL: 2CVE-2006-3396 – Mambo Module galleria 1.0b - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-3396
PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. Una vulnerabilidad de fichero PHP remoto en galleria.html.php en Galleria Mambo Module en su versión 1.0 y anteriores para Mambo permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro mosConfig_absolute_path. • https://www.exploit-db.com/exploits/1981 http://secunia.com/advisories/20949 http://securityreason.com/securityalert/1197 http://securitytracker.com/id?1016437 http://www.osvdb.org/27010 http://www.securityfocus.com/archive/1/439035/100/0/threaded http://www.securityfocus.com/archive/1/439624/100/0/threaded http://www.securityfocus.com/bid/18808 http://www.vupen.com/english/advisories/2006/2666 https://exchange.xforce.ibmcloud.com/vulnerabilities/27528 • CWE-94: Improper Control of Generation of Code ('Code Injection') •