Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: Contest Gallery Pro 19.1.5 Clear all filters
TI-2022-03798 CVE-2022-4152 · GHSA-6vhw-xj9w-j95w

Contest Gallery < 19.1.5 - Author+ SQL Injection

Priority MEDIUM 62

The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concatenating it to an SQL query in edit-options.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00932 Published 2022-12-26 Fixed in 19.1.5
TI-2022-03800 CVE-2022-4154 · GHSA-hg63-3m66-v3xg

Contest Gallery Pro < 19.1.5 - Admin+ SQL Injection

Priority MEDIUM 56

The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00929 Published 2022-12-26 Fixed in 19.1.5