CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2014-5186 – All Video Gallery Plugin for WordPress <= 1.2 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2014-5186
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php. Vulnerabilidad de inyección SQL en el plugin All Video Gallery (all-video-gallery) 1.2 para WordPress permite a administradores remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro id en una acción edit en la página allvideogallery_videos en wp-admin/admin.php. • http://codevigilant.com/disclosure/wp-plugin-all-video-gallery-a1-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4553 – WP-RSS-Spreadshirt-3DCube-Gallery <= 1.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4553
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en el plugin spreadshirt-rss-3d-cube-flash-gallery versión 2014 para WordPress, permite a atacantes remotos ejecutar script web o HTML arbitrario por medio de parámetros no especificados. Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin through version 1.3 for WordPress allows remote attackers to execute arbitrary web script or HTML via url parameter. • http://codevigilant.com/disclosure/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2014-4529 – Flash Photo Gallery <= 0.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4529
Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter. Vulnerabilidad de XSS en fpg_preview.php en el plugin Flash Photo Gallery 0.7 y anteriores para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro path. • http://codevigilant.com/disclosure/wp-plugin-flash-photo-gallery-a3-cross-site-scripting-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4919 – WordPress Gallery Plugin <= 1.4 - Unauthenticated Remote File Inclusion
https://notcve.org/view.php?id=CVE-2012-4919
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability Gallery Plugin versión 1.4 para WordPress, presenta una Vulnerabilidad de Inclusión de Archivo Remota. The WordPress Gallery Plugin plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 1.4 via the 'load' parameter. This allows unauthenticated attackers to include remote files on the server, resulting in code execution. • http://www.securityfocus.com/bid/57650 https://exchange.xforce.ibmcloud.com/vulnerabilities/81713 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 7.5EPSS: 2%CPEs: 2EXPL: 1CVE-2012-6653 – All Video Gallery <= 1.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-6653
Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors. Vulnerabilidad no especificada en el plugin All Video Gallery (all-video-gallery) anterior a 1.2.0 para WordPress tiene un impacto y vectores de ataque no especificados. The All Video Gallery plugin for WordPress is vulnerable to blind SQL Injection via the ‘ vid’ and 'pid' parameters in versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://www.exploit-db.com/exploits/22427 http://wordpress.org/plugins/all-video-gallery/changelog • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •