A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
Max CVSS
4.8
EPSS Score
0.11%
Published
2021-03-22
Updated
2022-05-23
4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. This vulnerability can result in an attacker to inject the XSS payload into the IMAGE URL. Each time a user visits that URL, the XSS triggers and the attacker can be able to steal the cookie according to the crafted payload.
Max CVSS
4.8
EPSS Score
0.09%
Published
2021-01-26
Updated
2021-02-01
Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.
Max CVSS
4.3
EPSS Score
0.21%
Published
2015-10-05
Updated
2015-10-06
Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.
Max CVSS
5.8
EPSS Score
0.42%
Published
2012-02-08
Updated
2017-08-29
SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.
Max CVSS
7.5
EPSS Score
0.06%
Published
2012-02-08
Updated
2017-08-29
Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action.
Max CVSS
4.3
EPSS Score
0.48%
Published
2012-02-08
Updated
2017-08-29
Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.
Max CVSS
4.3
EPSS Score
0.25%
Published
2009-07-08
Updated
2017-08-17
Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.
Max CVSS
6.8
EPSS Score
0.13%
Published
2009-06-19
Updated
2009-06-25
Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture.
Max CVSS
3.5
EPSS Score
0.11%
Published
2009-06-19
Updated
2017-09-29
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.
Max CVSS
7.5
EPSS Score
5.09%
Published
2006-10-11
Updated
2018-10-17
Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.php.
Max CVSS
2.6
EPSS Score
0.92%
Published
2006-04-25
Updated
2018-10-18
11 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!