CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4CVE-2009-4569 – Elkagroup - SQL Injection
https://notcve.org/view.php?id=CVE-2009-4569
SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the id parameter to the default URI under news/. Vulnerabilidad de inyección SQL en elkagroup Image Gallery permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro id a la URI por defecto bajo news/. • https://www.exploit-db.com/exploits/10330 http://packetstormsecurity.org/0912-exploits/elkagroupv-sql.txt http://www.exploit-db.com/exploits/10330 http://www.securityfocus.com/bid/37229 https://exchange.xforce.ibmcloud.com/vulnerabilities/54585 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2009-1446 – Elkagroup Image Gallery 1.0 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2009-1446
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in gallery/pictures/. NOTE: some of these details are obtained from third party information. Una vulnerabilidad de subida de ficheros sin restricciones en upload.php en Elkagroup Image Gallery v1.0 permite a los usuarios remotos autenticados ejecutar código arbitrario mediante la subida de un archivo con una extensión ejecutable para, a continuación, acceder a él a través de una solicitud directa al archivo en gallery/pictures/. NOTA: Algunos de estos detalles se obtienen a partir de información de terceros. • https://www.exploit-db.com/exploits/8514 http://osvdb.org/54115 http://secunia.com/advisories/25844 http://www.securityfocus.com/bid/34679 http://www.vupen.com/english/advisories/2009/1149 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2008-5037 – Elkagroup Image Gallery 1.0 - 'view.php' SQL Injection
https://notcve.org/view.php?id=CVE-2008-5037
SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter. Vulnerabilidad de inyección SQL en view.php en ElkaGroup Image Gallery v1.0 permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "cid". • https://www.exploit-db.com/exploits/32542 http://packetstorm.linuxsecurity.com/0810-exploits/elkagroup-sql.txt http://secunia.com/advisories/25844 http://www.securityfocus.com/bid/31966 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 19%CPEs: 1EXPL: 1CVE-2007-3461 – Elkagroup Image Gallery 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2007-3461
SQL injection vulnerability in property.php in elkagroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter. Vulnerabilidad de inyección SQL en property.php en elkagroup Image Gallery 1.0 permite a atacantes remotos ejecutar comandos SQl de su elección a travé del parámetro pid. • https://www.exploit-db.com/exploits/4114 http://osvdb.org/36294 http://secunia.com/advisories/25844 http://www.securityfocus.com/bid/24666 https://exchange.xforce.ibmcloud.com/vulnerabilities/35090 •