Photo Gallery vulnerabilities
4 known vulnerabilities in Photo Gallery from 10Web. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Limitation of a Pathname to a Restricted Directory
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) th
- 7.2 High severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Limitation of a Pathname to a Restricted Directory
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitra
- 9.8 Critical severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Neutralization of Special Elements used in an SQL Command
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- 9.8 Critical severity
Photo Gallery by 10Web – Mobile-Friendly Image…: Improper Neutralization of Special Elements used in an SQL Command
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), lea