CVE-2022-1282: falha em Photo Gallery by 10Web – Mobile-Friendly Image…
Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.9%
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
Produtos afetados
Unknown · Photo Gallery by 10Web – Mobile-Friendly Image GalleryCVEs relacionadas — Photo Gallery by 10Web – Mobile-Friendly Image…
No mesmo produto, das mais perigosas para as menos.
CVE-2022-0169—Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL InjectionEPSS 74.6%CVE-2022-1281—Photo Gallery < 1.6.3 - Unauthenticated SQL InjectionEPSS 43.4%CVE-2021-24363—Photo Gallery < 1.5.75 - File Upload Path TraversalEPSS 1.9%CVE-2022-1394—Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.1%CVE-2021-25041—Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2021-24362—Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVGEPSS 0.8%