Phpwebgallery » Phpwebgallery » 1.4.0 : Security Vulnerabilities, CVEs,
plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.
Max CVSS
9.0
EPSS Score
0.88%
Published
2008-10-22
Updated
2017-09-29
Multiple cross-site scripting (XSS) vulnerabilities in Phpwebgallery 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) login or (2) mail_address field in Register.php, or the (3) search_author, (4) mode, (5) start_year, (6) end_year, or (7) date_type field in Search.php, a different vulnerability than CVE-2006-1674. NOTE: 1.6.2 and other versions might also be affected.
Max CVSS
4.3
EPSS Score
0.76%
Published
2007-02-26
Updated
2018-10-16
Multiple SQL injection vulnerabilities in PhpWebGallery 1.5.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) since, (2) sort_by, and (3) items_number parameters to comments.php, (4) the search parameter to category.php, and (5) image_id parameter to picture.php. NOTE: it was later reported that the comments.php/sort_by vector also affects 1.7.2 and earlier.
Max CVSS
7.5
EPSS Score
0.21%
Published
2005-12-14
Updated
2011-03-07
3 vulnerabilities found