CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 1CVE-2008-0504 – Coppermine Photo Gallery 1.4.10 - 'cpg1410_xek.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0504
Multiple SQL injection vulnerabilities in Coppermine Photo Gallery (CPG) before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) albumid, (2) startpic, and (3) numpics parameters to util.php; and (4) cid_array parameter to reviewcom.php. Múltiples vulnerabilidades de inyección SQL en Coppermine Photo Gallery (CPG) en versiones anteriores a la 1.4.15 permiten que administradores remotos autenticados ejecuten comandos SQL arbitrarios mediante los parámetros (1) albumid, (2) startpic y (3) numpics en util.php; y el parámetro (4) cid_array en reviewcom.php. • https://www.exploit-db.com/exploits/4950 http://coppermine-gallery.net/forum/index.php?topic=50103.0 http://secunia.com/advisories/28682 http://www.securityfocus.com/archive/1/487351/100/200/threaded http://www.securityfocus.com/bid/27509 http://www.securitytracker.com/id?1019285 http://www.vupen.com/english/advisories/2008/0367 http://www.waraxe.us/advisory-66.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6686
https://notcve.org/view.php?id=CVE-2007-6686
The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller. El módulo URL rewrite para Menalto Gallery anterior a 2.2.4 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección mediante vectores desconocidos relacionados con el controlador de la administración. • http://bugs.gentoo.org/show_bug.cgi?id=203217 http://gallery.menalto.com/gallery_2.2.4_released http://osvdb.org/41674 http://secunia.com/advisories/28898 http://security.gentoo.org/glsa/glsa-200802-04.xml •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6687
https://notcve.org/view.php?id=CVE-2007-6687
Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before 2.2.4 allow remote attackers to inject arbitrary web script or HTML via crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP PROPPATCH in the WebDAV module. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Menalto Gallery anterior a 2.2.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante nombres de fichero manipulados a los módulos (1) Core o (2) add-item; o mediante (3) HTTP PROPPATCH en el módulo WebDAV. • http://bugs.gentoo.org/show_bug.cgi?id=203217 http://gallery.menalto.com/gallery_2.2.4_released http://osvdb.org/41671 http://osvdb.org/41672 http://osvdb.org/41673 http://secunia.com/advisories/28898 http://security.gentoo.org/glsa/glsa-200802-04.xml • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6688
https://notcve.org/view.php?id=CVE-2007-6688
Unspecified vulnerability in the Installation application in Menalto Gallery before 2.2.4 has unknown impact and attack vectors related to "web-accessibility protection of the storage folder." Vulnerabilidad no especificada en la aplicación de instalacón en Menalto Gallery, en versiones anteriores a la 2.2.4. Tiene un impacto desconocido y vectores de ataque relacionados con "Proteccion de la accesibilidad web del directorio de almacenamiento" • http://bugs.gentoo.org/show_bug.cgi?id=203217 http://gallery.menalto.com/gallery_2.2.4_released http://osvdb.org/41670 http://secunia.com/advisories/28898 http://security.gentoo.org/glsa/glsa-200802-04.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/39987 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6689
https://notcve.org/view.php?id=CVE-2007-6689
Menalto Gallery before 2.2.4 does not properly check for malicious file extensions during file uploads, which allows attackers to execute arbitrary code via the (1) Core application or (2) MIME module. Menalto Gallery anterior a 2.2.4 no comprueba extensiones de fichero maliciosas durante la subida de ficheros, lo cual permite a atacantes remotos ejecutar código de su elección mediante los módulos (1) Core o (2) MIME. • http://bugs.gentoo.org/show_bug.cgi?id=203217 http://gallery.menalto.com/gallery_2.2.4_released http://osvdb.org/41669 http://secunia.com/advisories/28898 http://security.gentoo.org/glsa/glsa-200802-04.xml • CWE-20: Improper Input Validation •