Vulnerabilities > Yapig

DATE CVE VULNERABILITY TITLE RISK
2006-08-29 CVE-2006-4421 Cross-Site Scripting vulnerability in Yapig 0.95B
Cross-site scripting (XSS) vulnerability in template/default/thanks_comment.php in Yet Another PHP Image Gallery (YaPIG) 0.95b allows remote attackers to inject arbitrary web script or HTML via the D_REFRESH_URL parameter.
network
yapig
4.3
2005-12-31 CVE-2005-4801 Cross-Site Request Forgery vulnerability in YaPig
Multiple cross-site request forgery (CSRF) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user, as demonstrated by tricking the administrator to access a web page that performs a mod_info action in modify_gallery.php.
network
low complexity
yapig
7.5
2005-12-31 CVE-2005-4800 Remote Security vulnerability in YaPig
Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php, which inserts the code into guid_info.php.
network
low complexity
yapig
critical
9.0
2005-12-31 CVE-2005-4799 Cross-Site Scripting vulnerability in Yapig
Multiple cross-site scripting (XSS) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Homepage field (aka the Website field) in an "image-related comment" and (2) the img_size field in view.php.
network
high complexity
yapig
5.1
2005-08-30 CVE-2005-2736 Unspecified vulnerability in Yapig
Cross-site scripting (XSS) vulnerability in YaPig 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.
network
yapig
4.3
2005-06-09 CVE-2005-1886 Cross-Site Scripting vulnerability in Yapig 0.92B/0.93U/0.94U
Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.
network
yapig
4.3
2005-06-09 CVE-2005-1884 Directory Traversal vulnerability in Yapig 0.92B/0.93U/0.94U
Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a ..
network
low complexity
yapig
6.4
2005-06-09 CVE-2005-1883 Remote Security vulnerability in Yapig 0.92B
global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.
network
low complexity
yapig
5.0
2005-06-09 CVE-2005-1882 Remote Security vulnerability in Yapig 0.93U/0.94U
PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIG_PATH parameter.
network
low complexity
yapig
7.5
2005-06-06 CVE-2005-1885 Information Disclosure vulnerability in Yapig 0.92B/0.93U/0.94U
view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message.
network
low complexity
yapig
5.0