10web: >> Photo Gallery >> 1.3.61 Security Vulnerabilities
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
CVSS Score
4.9
EPSS Score
0.007
Published
2019-08-09
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
CVSS Score
9.8
EPSS Score
0.041
Published
2019-07-30
Page 5