CVE-2021-24139: vulnerability in Photo Gallery by 10Web
Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 5.5%
from disclosure to weapon
Published on NVDMar 18
VulnCheck+677d
Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
Affected products
Unknown · Photo Gallery by 10WebRelated CVEs — Photo Gallery by 10Web
In the same product, most dangerous first.
CVE-2023-1427MEDIUMPhoto Gallery by 10Web < 1.8.15 - Admin+ Path TraversalEPSS 0.8%CVE-2024-10704MEDIUMPhoto Gallery by 10Web < 1.8.31 - Admin+ Stored XSSEPSS 0.4%CVE-2024-5968MEDIUMPhoto Gallery by 10Web <= 1.8.27 - Admin+ Stored XSSEPSS 0.4%CVE-2024-8670MEDIUMPhoto Gallery by 10Web < 1.8.29 - Admin+ Stored XSSEPSS 0.4%CVE-2025-0613MEDIUMPhoto Gallery < 1.8.34 - Unauthenticated Stored XSSEPSS 0.3%CVE-2026-12865HIGHPhoto Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged ParametersEPSS 0.3%