10web
Page 2 of 2 — 10web CVEs from a corpus of 130, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1320 | Medium | 4.8 | 2022-05-23 | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as ad… |
CVE-2022-1282 | Medium | 6.1 | 2022-05-02 | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when… |
CVE-2022-1281 | Critical | 9.8 | 2022-05-02 | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Inj… |
CVE-2022-0169 | Critical | 9.8 | 2022-03-14 | The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statem… |
CVE-2022-0212 | Medium | 6.1 | 2022-02-14 | The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJA… |
CVE-2021-25047 | Medium | 6.1 | 2022-01-10 | The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin… |
CVE-2021-25041 | Medium | 6.1 | 2021-12-06 | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and short… |
CVE-2021-24526 | Medium | 5.4 | 2021-08-16 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it… |
CVE-2021-24363 | Medium | 4.9 | 2021-08-16 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder… |
CVE-2021-24362 | Medium | 6.1 | 2021-08-16 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not cont… |
CVE-2021-24310 | Medium | 4.8 | 2021-06-01 | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege… |
CVE-2021-24291 | Medium | 6.1 | 2021-05-14 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the… |
CVE-2021-24139 | Critical | 9.8 | 2021-03-18 | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php… |
CVE-2021-24132 | High | 8.8 | 2021-03-18 | The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulk_action, export_full and save_slider_db functionalities of the plugin were vulnerable… |
CVE-2020-9335 | Medium | 4.8 | 2020-02-25 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow… |
CVE-2015-1394 | Medium | 5.4 | 2020-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrar… |
CVE-2019-16119 | Critical | 9.8 | 2019-09-08 | SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id param… |
CVE-2019-16118 | Medium | 6.1 | 2019-09-08 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php. |
CVE-2019-16117 | Medium | 6.1 | 2019-09-08 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php. |
CVE-2015-9380 | High | 8.8 | 2019-08-30 | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. |
CVE-2019-14798 | Medium | 4.9 | 2019-08-09 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action… |
CVE-2019-14797 | Medium | 5.4 | 2019-08-09 | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. |
CVE-2019-14313 | Critical | 9.8 | 2019-07-30 | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a… |
CVE-2019-10866 | Critical | 9.8 | 2019-05-23 | In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin… |
CVE-2019-11590 | High | 8.8 | 2019-04-29 | The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via d… |
CVE-2015-2324 | Medium | 5.4 | 2018-02-19 | Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit… |
CVE-2014-9312 | High | 8.8 | 2017-08-28 | Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. |
CVE-2017-12977 | High | 7.2 | 2017-08-21 | The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag()… |
CVE-2015-1393 | | 2015-02-02 | SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the… | |
CVE-2015-1055 | | 2015-01-16 | SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by paramete… |