Simple Photo Gallery Vulnerabilities

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.

Affected:

up to 1.8.1

Fix:

No patched version reported

Disclosed:

Nov 3, 2023

CVE-2022-47588 on NVD →

Update the plugin. Viktor Gazdag discovered and reported this SQL Injection vulnerability in WordPress Simple Photo Gallery Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 1.8.0.

Affected:

up to 1.8.0

Fixed in:

1.8.0

Disclosed:

May 21, 2023

Update the plugin. Oliveira Lima discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Simple Photo Gallery Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests...

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Apr 28, 2023

The Simple Photo Gallery plugin for WordPress is vulnerable to generic SQL Injection via the ‘item’ parameter in versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for administrator-level...

CVSS:

9.1

Affected:

up to 1.8.1

Fix:

No patched version reported

Disclosed:

Jan 27, 2023

CVE-2022-47588 on NVD →

The Simple Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec...

CVSS:

7.2

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Apr 28, 2016

Because of this vulnerability, attackers can execute malicious cides on name input of the gallery and album. Update the plugin.

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Apr 28, 2016

The Simple Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec...

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Apr 28, 2016

This plugin is prone to an SQL injection vulnerability in the "gallery_id" parameter. Update the plugin.

Affected:

up to 1.8.0

Fixed in:

1.8.0

Disclosed:

May 21, 2015

26-April-2016 - Reported 27-April-2016 - Vendor Response 27 -April-2016 - Vendor Fixed 28-April-2016 - Public disclosed

Affected:

up to 1.8.1

Fixed in:

1.8.1

MySQL >= 5.0.12 AND time-based blind (SELECT) sql injection in the gallery_id parameter.

Affected:

up to 1.8.0

Fixed in:

1.8.0