CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27853 – WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2022-27853
20 Dec 2021 — Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9 Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado Autenticado (rol de autor o superior) en Contest Gallery (plugin de WordPress) versiones anteriores a 13.1.0.9 incluyéndola • https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-13-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 74%CPEs: 1EXPL: 2CVE-2021-24915 – Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
https://notcve.org/view.php?id=CVE-2021-24915
29 Nov 2021 — The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address El plugin Contest Gallery de WordPress versiones anteriores a 13.1.0.6, no presenta comprobaciones de capac... • https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-38753
https://notcve.org/view.php?id=CVE-2021-38753
16 Aug 2021 — An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app. Una carga de archivos no restringida en la aplicación web Simple Image Gallery, puede ser explotada para cargar una shell web y ejecutada para conseguir acceso no autorizado al servidor que aloja la aplicación web. • https://github.com/dumpling-soup/Simple-Image-Gallery-Web-App/blob/main/README.md • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24349 – Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24349
26 May 2021 — This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector. Esta Galería del plugin de WordPress de archivos versiones hasta 1.6.0, otorga la funcionalidad de subir imágenes al servidor. Pero los nombres de... • https://wpscan.com/vulnerability/6bb4eb71-d702-4732-b01f-b723077d66ca • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.0EPSS: 11%CPEs: 1EXPL: 3CVE-2020-28687 – Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile
https://notcve.org/view.php?id=CVE-2020-28687
16 Nov 2020 — The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. La funcionalidad edit profile en ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT AND MYSQL versión 1.0, permite a atacantes remotos cargar archivos Artworks Gallery version 1.0 suffers from multiple remote shell upload vulnerabilities. • https://packetstorm.news/files/id/160095 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 11%CPEs: 1EXPL: 3CVE-2020-28688 – Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Add Artwork
https://notcve.org/view.php?id=CVE-2020-28688
16 Nov 2020 — The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. La funcionalidad add artwork en ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT AND MYSQL versión 1.0, permite a atacantes remotos cargar archivos Artworks Gallery version 1.0 suffers from multiple remote shell upload vulnerabilities. • https://packetstorm.news/files/id/160095 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2010-4815
https://notcve.org/view.php?id=CVE-2010-4815
05 Feb 2020 — Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. La galería Coppermine versiones anteriores a 1.4.26, presenta una vulnerabilidad de comprobación de entrada que permite una ejecución de código. • https://forum.coppermine-gallery.net/index.php/topic%2C63510.0.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-7482 – ReFlex Gallery < 1.4.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-7482
22 Aug 2019 — The reflex-gallery plugin before 1.4.3 for WordPress has XSS. El plugin reflex-gallery anterior a 1.4.3 para WordPress tiene XSS. The reflex-gallery plugin before 1.4.3 for WordPress has XSS via Edit Content URL field. • https://wordpress.org/plugins/reflex-gallery/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-5974 – Contest Gallery – Photo Contest Plugin for WordPress <= 10.4.4 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-5974
12 Jun 2019 — Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en Contest Gallery versiones anteriores a 10.4.5, permite a los atacantes remotos secuestrar la autenticación de administradores por medio de vectores no especificados. • https://jvn.jp/en/jp/JVN80925867/index.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-14478 – Coppermine 1.5.46 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-14478
23 Jan 2019 — ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter. ecard.php en Coppermine Photo Gallery (CPG) 1.5.46 tiene XSS a través del parámetro sender_name, recipient_email, greetings, o recipient_name. Coppermine version 1.5.46 suffers from multiple cross site scripting vulnerabilities. • https://packetstorm.news/files/id/151306 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •