CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 1CVE-2025-0722 – needyamin image_gallery Cover Image gallery.php unrestricted upload
https://notcve.org/view.php?id=CVE-2025-0722
26 Jan 2025 — A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?ctiid.293482 • CWE-284: Improper Access Control CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2025-0721 – needyamin image_gallery view.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-0721
26 Jan 2025 — A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?ctiid.293481 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •