CVE-2023-53939

all versions

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious s

5.4MEDIUM

CVE-2023-53922

all versions

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated a

9.8CRITICAL

CVE-2025-1440

< 2025.0

The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback()

5.3MEDIUM

CVE-2025-1439

< 2025.0

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode

6.4MEDIUM

CVE-2025-1437

< 2025.3

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode

6.4MEDIUM

CVE-2024-1341

< 2024.2

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode i

4.9MEDIUM

CVE-2024-24870

< 2024.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFr

6.5MEDIUM

CVE-2023-51690

<= 2023.8

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Store

6.5MEDIUM

CVE-2023-7069

< 2024.0

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode

6.4MEDIUM

CVE-2023-4775

<= 2023.8

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versi

6.4MEDIUM

CVE-2021-24953

< 2022

The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back

6.1MEDIUM

CVE-2013-2631

<= 1.8.9

TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensi

5.3MEDIUM

CVE-2012-2931

< 1.8.8

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code

7.2HIGH

CVE-2014-5014

< 3.1.3

The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors r

9.8CRITICAL

CVE-2017-16635

all versions

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create modul

5.4MEDIUM

CVE-2012-2932

<= 1.8.6

Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrar

CVE-2012-2930

<= 1.8.6

Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack t

CVE-2012-5347

all versions

TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) in

CVE-2011-3810

all versions

TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reve

CVE-2009-1911

<= 1.7.6

Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in T

CVE-2007-4958

all versions

Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web

CVE-2006-4166

<= 1.5

PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code vi

CVE-2006-1802

all versions

Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary we