Snipegallery Snipe Gallery vulnerabilities
4 known vulnerabilities affecting snipegallery/snipe_gallery.
Total CVEs
4
CISA KEV
0
Public exploits
3
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2010-2126P3HIGHCVSS 7.5PoCv3.1.52010-06-01
CVE-2010-2126 [HIGH] CWE-94 CVE-2010-2126: Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to
Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_admin_path parameter to (1) index.php, (2) view.php, (3) image.php, (4) search.php, (5) admin/index.php, (6) admin/gallery/index.php, (7) admin/gallery/view.php, (8) admin/gallery/gallery.php, (9) admin/galler
nvd
CVE-2005-4244P3HIGHCVSS 7.5PoC≤ 3.1.42005-12-14
CVE-2005-4244 [HIGH] CWE-89 CVE-2005-4244: SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute ar
SQL injection vulnerability in Snipe Gallery 3.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) gallery_id parameter to view.php and (2) image_id parameter to image.php.
nvd
CVE-2005-4245P4MEDIUMCVSS 4.3PoC≤ 3.1.42005-12-14
CVE-2005-4245 [MEDIUM] CWE-79 CVE-2005-4245: Cross-site scripting (XSS) vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows rem
Cross-site scripting (XSS) vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
nvd
CVE-2006-1826P4MEDIUMCVSS 4.3≤ 3.1.42006-04-18
CVE-2006-1826 [MEDIUM] CWE-79 CVE-2006-1826: Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote
Multiple cross-site scripting (XSS) vulnerabilities in Snipe Gallery 3.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in view.php, (2) keyword parameter in search.php, and (3) image_id parameter in image.php. NOTE: it is possible that vectors 1 and 3 are resultant from SQL injection.
nvd