Tinywebgallery - vulnerabilities (CVEs)

23 CVEs in 3 products, 0 in the last 30 days, newest from 2025-12-18.

Products

Newest CVEs of Tinywebgallery

CVE-2023-53939 - CVSS 5.4 (medium), 2025-12-18: TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder…
CVE-2023-53922 - CVSS 9.8 (critical), 2025-12-17: TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious…
CVE-2025-1439 - CVSS 6.4 (medium), 2025-03-26: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and…
CVE-2025-1440 - CVSS 5.3 (medium), 2025-03-26: The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up…
CVE-2025-1437 - CVSS 6.4 (medium), 2025-03-26: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and…
CVE-2024-1341 - CVSS 5.4 (medium), 2024-02-29: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and…
CVE-2024-24870 - CVSS 6.5 (medium), 2024-02-05: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This…
CVE-2023-51690 - CVSS 6.5 (medium), 2024-02-01: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects…
CVE-2023-7069 - CVSS 6.4 (medium), 2024-02-01: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and…
CVE-2023-4775 - CVSS 6.4 (medium), 2023-11-13: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including,…
CVE-2021-24953 - CVSS 6.1 (medium), 2022-03-07: The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading…
CVE-2013-2631 - CVSS 5.3 (medium), 2020-02-03: TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the…
CVE-2012-2931 - CVSS 7.2 (high), 2020-01-09: PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file.
CVE-2014-5014 - CVSS 9.8 (critical), 2018-04-25: The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters…
CVE-2017-16635 - CVSS 5.4 (medium), 2017-11-06: In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote attackers with…
CVE-2012-2932 - CVSS 4.3 (medium), 2015-04-24: Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-2930 - CVSS 6.8 (medium), 2015-04-24: Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of…
CVE-2012-5347 - CVSS 7.5 (high), 2012-10-09: TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2)…
CVE-2011-3810 - CVSS 5 (medium), 2011-09-24: TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in…
CVE-2009-1911 - CVSS 6.8 (medium), 2009-06-04: Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6…
CVE-2007-4958 - CVSS 4.3 (medium), 2007-09-18: Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI…
CVE-2006-4166 - CVSS 7.5 (high), 2006-08-16: PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image…
CVE-2006-1802 - CVSS 4.3 (medium), 2006-04-18: Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the…