TI-2026-20910 CVE-2026-25869 · GHSA-44fr-rgw9-2p52
MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter
Priority LOW 37
MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter.
MiniGal
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
MiniGal records in CISA KEVNo MiniGal vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2007-02067 CVE-2007-2146 · GHSA-g7fw-7775-6f78
The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject…
Priority LOW 37
The imagecomments function in classes.php in MiniGal b13 allow remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the (1) name or (2) email parameter.
TI-2007-02066 CVE-2007-2145 · GHSA-cjxg-667g-2p2g
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to…
Priority LOW 37
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via the input parameter.
TI-2008-06621 CVE-2008-6933 · GHSA-48m4-gq2m-xcx4
Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote…
Priority LOW 28
Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly the content of other files, via a ..
TI-2026-20909 CVE-2026-25868 · GHSA-6wm3-23gq-r92x
MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter
Priority LOW 23
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter.
TI-2008-01180 CVE-2008-1228 · GHSA-xxc3-qjmw-rfr6
Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HTML via the list parameter in an import action.