Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Release: Contest Gallery, Contest Gallery Pro 19.1.5.1 Clear all filters
TI-2022-03806 CVE-2022-4160 · GHSA-r8rq-8q99-cp9f

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-comments.php and c…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00993 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03797 CVE-2022-4151 · GHSA-ffcj-jj5c-qxj6

Contest Gallery < 19.1.5 - Admin+ SQL Injection

Priority MEDIUM 64

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1 CWE-89
TI-2022-03805 CVE-2022-4159 · GHSA-9879-5jr5-xwq3

Contest Gallery < 19.1.5.1 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-gallery.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03808 CVE-2022-4162 · GHSA-hjvh-7p9j-42v8

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-order.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03810 CVE-2022-4164 · GHSA-5949-jwff-8f6q

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-g…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03802 CVE-2022-4156 · GHSA-gwm8-pp4m-5w63

Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection

Priority HIGH 72

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01004 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03809 CVE-2022-4163 · GHSA-43gx-fr8q-99g5

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in 2_deac…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03812 CVE-2022-4166 · GHSA-7hx6-3mh5-45rj

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03796 CVE-2022-4150 · GHSA-ggw6-9p9v-2x3p

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-an…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03804 CVE-2022-4158 · GHSA-x2v8-685r-x7hf

Contest Gallery < 19.1.5 - Unauthenticated SQL Injection

Priority HIGH 72

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-regist…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00962 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03811 CVE-2022-4165 · GHSA-9w3p-jqjp-v5ww

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03801 CVE-2022-4155 · GHSA-43qm-4w5w-7m4c

Contest Gallery < 19.1.5 - Admin+ SQL Injection

Priority MEDIUM 56

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00923 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03803 CVE-2022-4157 · GHSA-9p2g-49fh-fv3m

Contest Gallery < 19.1.5 - Admin+ SQL Injection

Priority MEDIUM 56

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00963 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03799 CVE-2022-4153 · GHSA-9hch-f25p-q8wm

Contest Gallery < 19.1.5.1 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.p…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1
TI-2022-03807 CVE-2022-4161 · GHSA-cc5j-v6q7-cx9f

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-images.php…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5.1 CWE-89