Vulnerabilities > 10Web > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-08-09 | CVE-2019-14798 | Path Traversal vulnerability in 10Web Photo Gallery The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter. | 4.0 |
| 2019-04-29 | CVE-2019-11590 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in 10Web Form Maker The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized. | 6.8 |
| 2017-08-28 | CVE-2014-9312 | Unrestricted Upload of File with Dangerous Type vulnerability in 10Web Photo Gallery 1.2.5 Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. | 6.5 |
| 2017-08-21 | CVE-2017-12977 | SQL Injection vulnerability in 10Web Photo Gallery The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. | 6.5 |
| 2015-02-02 | CVE-2015-1393 | SQL Injection vulnerability in 10Web Photo Gallery SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php. | 6.5 |