CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4553 – WP-RSS-Spreadshirt-3DCube-Gallery <= 1.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4553
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el plugin spreadshirt-rss-3d-cube-flash-gallery versión 2014 para WordPress, permite a atacantes remotos ejecutar script web o HTML arbitrario por medio de parámetros no especificados. Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin through version 1.3 for WordPress allows remote attackers to execute arbitrary web script or HTML via url parameter. • http://codevigilant.com/disclosure/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2014-4529 – Flash Photo Gallery <= 0.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4529
Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter. Vulnerabilidad de XSS en fpg_preview.php en el plugin Flash Photo Gallery 0.7 y anteriores para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro path. • http://codevigilant.com/disclosure/wp-plugin-flash-photo-gallery-a3-cross-site-scripting-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4919 – WordPress Gallery Plugin <= 1.4 - Unauthenticated Remote File Inclusion
https://notcve.org/view.php?id=CVE-2012-4919
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability Gallery Plugin versión 1.4 para WordPress, presenta una Vulnerabilidad de Inclusión de Archivo Remota. The WordPress Gallery Plugin plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 1.4 via the 'load' parameter. This allows unauthenticated attackers to include remote files on the server, resulting in code execution. • http://www.securityfocus.com/bid/57650 https://exchange.xforce.ibmcloud.com/vulnerabilities/81713 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2012-6653 – All Video Gallery <= 1.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-6653
Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors. Vulnerabilidad no especificada en el plugin All Video Gallery (all-video-gallery) anterior a 1.2.0 para WordPress tiene un impacto y vectores de ataque no especificados. The All Video Gallery plugin for WordPress is vulnerable to blind SQL Injection via the ‘ vid’ and 'pid' parameters in versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://www.exploit-db.com/exploits/22427 http://wordpress.org/plugins/all-video-gallery/changelog • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 0CVE-2006-4030
https://notcve.org/view.php?id=CVE-2006-4030
Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and earlier allows remote attackers to obtain sensitive information via unspecified attack vectors, related to "two file exposure bugs." Vulnerabilidad no especificada en el módulo de estadísticas en Gallery 1.5.1-RC2 y anteriores permite a atacantes remotos obtener información sensible a través de vectores de ataque desconocidos, relacionados con "dos bugs de exposición de archivos". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285 http://secunia.com/advisories/16594 http://secunia.com/advisories/21502 http://www.debian.org/security/2006/dsa-1148 http://www.securityfocus.com/bid/19453 http://www.vupen.com/english/advisories/2006/3250 •