CVE-2024-29832: falha de média gravidade em 10Web PhotoGallery
WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.4%
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.
Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
10Web · PhotoGalleryCVEs relacionadas — 10Web PhotoGallery
No mesmo produto, das mais perigosas para as menos.
CVE-2024-29833MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandlerEPSS 0.4%CVE-2024-29810MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_urlEPSS 0.4%CVE-2024-29809MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_urlEPSS 0.4%CVE-2024-29808MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_idEPSS 0.4%