CVE-2022-1394: falha em Photo Gallery by 10Web – Mobile-Friendly Image…
Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.1%
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Produtos afetados
Unknown · Photo Gallery by 10Web – Mobile-Friendly Image GalleryCVEs relacionadas — Photo Gallery by 10Web – Mobile-Friendly Image…
No mesmo produto, das mais perigosas para as menos.
CVE-2022-0169—Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL InjectionEPSS 74.6%CVE-2022-1281—Photo Gallery < 1.6.3 - Unauthenticated SQL InjectionEPSS 43.4%CVE-2021-24363—Photo Gallery < 1.5.75 - File Upload Path TraversalEPSS 1.9%CVE-2021-25041—Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2022-1282—Photo Gallery < 1.6.3 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-24362—Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVGEPSS 0.8%