CVE-2023-53939 | Medium | 5.4 | 2025-12-18 | TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder nam… |
CVE-2023-53922 | Critical | 9.8 | 2025-12-17 | TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious… |
CVE-2025-1440 | Medium | 5.3 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up… |
CVE-2025-1439 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-1437 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2024-1341 | Medium | 4.9 | 2024-02-29 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and inc… |
CVE-2024-24870 | Medium | 6.5 | 2024-02-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This is… |
CVE-2023-51690 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Adva… |
CVE-2023-7069 | Medium | 6.4 | 2024-02-01 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2023-4775 | Medium | 6.4 | 2023-11-13 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 202… |
CVE-2021-24953 | Medium | 6.1 | 2022-03-07 | The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to… |
CVE-2013-2631 | Medium | 5.3 | 2020-02-03 | TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the… |
CVE-2012-2931 | High | 7.2 | 2020-01-09 | PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file. |
CVE-2014-5014 | Critical | 9.8 | 2018-04-25 | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters… |
CVE-2017-16635 | Medium | 5.4 | 2017-11-06 | In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote attackers with low-… |
CVE-2012-2932 | | | 2015-04-24 | Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2012-2930 | | | 2015-04-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administ… |
CVE-2012-5347 | | | 2012-10-09 | TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) in… |
CVE-2011-3810 | | | 2011-09-24 | TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in… |
CVE-2009-1911 | | | 2009-06-04 | Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and… |
CVE-2007-4958 | | | 2007-09-18 | Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI f… |
CVE-2006-4166 | | | 2006-08-16 | PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image paramete… |
CVE-2006-1802 | | | 2006-04-18 | Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_… |