6.1
Moyenne
CVE-2024-29832 The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross…
Description
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| PhotoGallery 1.0 | 1.0.1 → 1.8.21 | Pas de correctif indiqué |
| photo_gallery 1.0 | 1.0.1 → 1.8.21 | Pas de correctif indiqué |
Autres CVE de PhotoGallery
Les 5 CVE de PhotoGallery →
CVE-2024-29833
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by…
5.4
Moyenne
CVE-2024-29810
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected…
5.4
Moyenne
CVE-2024-29809
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected…
5.4
Moyenne
CVE-2024-29808
The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross…
5.4
Moyenne