yapig yapig 0.94u vulnerabilities and exploits

(subscribe to this query)

9

CVSSv2

Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and previous versions allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php, which inserts the code...

Yapig Yapig 0.95 Yapig Yapig Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig 0.94u

7.5

CVSSv2

Multiple cross-site request forgery (CSRF) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and previous versions allow remote malicious users to perform unauthorized actions as a logged-in user, as demonstrated by tricking the administrator to access a web page tha...

Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig 0.94u Yapig Yapig 0.95 Yapig Yapig

7.5

CVSSv2

PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote malicious users to execute arbitrary PHP code via the YAPIG_PATH parameter.

Yapig Yapig 0.93u Yapig Yapig 0.94u

1 EDB exploit

7.5

CVSSv2

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote malicious users to upload arbitrary files and execute arbitrary PHP code.

Yapig Yapig 0.94u Yapig Yapig 0.93u Yapig Yapig 0.92b

1 EDB exploit

6.4

CVSSv2

Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote malicious users to create or delete arbitrary directories via a .. (dot dot) in the dir parameter.

Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig 0.94u

1 EDB exploit

5.1

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and previous versions allow remote malicious users to inject arbitrary web script or HTML via (1) the Homepage field (aka the Website field) in an "image-related comment" ...

Yapig Yapig 0.94u Yapig Yapig 0.95 Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig

1 EDB exploit

5

CVSSv2

view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote malicious users to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message.

Yapig Yapig 0.92b Yapig Yapig 0.94u Yapig Yapig 0.93u

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in YaPig 0.95 and previous versions allows remote malicious users to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.

Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig 0.94u Yapig Yapig 0.95 Yapig Yapig 0.95b

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote malicious users to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.

Yapig Yapig 0.92b Yapig Yapig 0.93u Yapig Yapig 0.94u

1 EDB exploit

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook