Vulnerabilities

TI-2012-03821 CVE-2012-4479 · GHSA-mwpc-rq5j-r7mq

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows…

LOW 35

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0113 Published 2012-11-30 No fix listed CWE-89

TI-2012-03820 CVE-2012-4478 · GHSA-98fr-cg7h-f734

Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0057 Published 2012-11-30 No fix listed CWE-352

TI-2012-03819 CVE-2012-4477 · GHSA-w33x-x8p6-7v77

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote…

LOW 25

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01187 Published 2012-11-30 No fix listed CWE-264

TI-2012-03818 CVE-2012-4476 · GHSA-4q8p-34wc-4gm5

Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal…

LOW 22

Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00931 Published 2012-11-30 No fix listed CWE-79

TI-2012-03814 CVE-2012-4472 · GHSA-j779-7gqj-qp8g

Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module…

LOW 26

Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.01448 Published 2012-11-30 No fix listed