Photo Gallery CVE-2024-37442

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2024-07-09 audit@patchstack.com

Code Injection Photo Gallery

5.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

1

CVE Published

Jul 09, 2024 - 11:15 nvd

MEDIUM 5.5

DescriptionNVD

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.

AnalysisAI

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.7.1. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-74. Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.7.1. Affected products include: Ays-Pro Photo Gallery. Version information: before 5.7.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Photo Gallery

View all

CVE-2014-9312 HIGH Act Now POC

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. Rated high severity (CVSS 8.8), this vulnerability is rem

CVE-2022-1281 CRITICAL Act Now POC

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is a

CVE-2022-0169 CRITICAL Act Now POC

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 pa

CVE-2021-24139 CRITICAL Act Now POC

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL inje

CVE-2021-24462 HIGH This Week POC

The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays - Responsive Image Gallery WordPr

CVE-2015-1055 HIGH This Week POC

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary

CVE-2015-1393 MEDIUM This Month POC

SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to

CVE-2025-0613 MEDIUM This Month POC

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unau

CVE-2024-29832 MEDIUM This Month POC

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross S

CVE-2023-2568 MEDIUM This Month POC

The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attr

CVE-2022-1282 MEDIUM This Month POC

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, whi

CVE-2021-25041 MEDIUM This Month POC

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues v

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all

CVE-2013-2251 CRITICAL POC

CVE-2016-4010 CRITICAL POC

CVE-2015-1592 HIGH POC

CVE-2025-20281 CRITICAL POC

CVE-2015-7309 MEDIUM POC

CVE-2014-8423 CRITICAL POC

CVE-2020-8468 HIGH POC

CVE-2015-3253 CRITICAL

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

Share

CVE-2024-37442 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy