Vulnerabilities

TI-2022-26262 CVE-2022-50806 · GHSA-r2jm-vp5j-vxhh

4images 1.9 - Remote Command Execution (RCE)

MEDIUM 42

4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01293 Published 2026-01-13 No fix listed CWE-94

TI-2021-08829 CVE-2021-27308 · GHSA-r57m-c9hr-x87c

A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version…

LOW 26

A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01994 Published 2021-03-22 No fix listed CWE-79

TI-2020-18297 CVE-2020-35853 · GHSA-v8x5-6v34-c2wf

4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS)…

LOW 23

4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2021-01-25 No fix listed CWE-79

TI-2015-06405 CVE-2015-7708 · GHSA-jmfr-g5h8-3hhv

Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01438 Published 2015-10-05 No fix listed CWE-79

TI-2012-00937 CVE-2012-1023 · GHSA-x6v7-57rh-8p7h

Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers…

LOW 30

Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01835 Published 2012-02-08 No fix listed CWE-20

TI-2012-00936 CVE-2012-1022 · GHSA-7985-8hqh-8j5p

SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to…

LOW 35

SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0101 Published 2012-02-08 No fix listed CWE-89

TI-2012-00935 CVE-2012-1021 · GHSA-32gw-r878-mrx5

Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows…

LOW 23

Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01528 Published 2012-02-08 No fix listed CWE-79

TI-2009-02270 CVE-2009-2380 · GHSA-mfqq-vjgh-p2ff

Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through…

LOW 22

Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01065 Published 2009-07-08 No fix listed CWE-79

TI-2009-02039 CVE-2009-2132 · GHSA-7p5m-cccg-gq8j

Directory traversal vulnerability in global.php in 4images before 1.7.7, when…

LOW 34

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02104 Published 2009-06-19 No fix listed CWE-22

TI-2009-02038 CVE-2009-2131 · GHSA-vw7q-599g-vw99

Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote…

LOW 20

Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then postin…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01602 Published 2009-06-19 No fix listed CWE-79

TI-2006-05052 CVE-2006-5236 · GHSA-mhj8-73hh-3fc8

SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated…

LOW 37

SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02117 Published 2006-10-11 No fix listed

TI-2006-01956 CVE-2006-2011 · GHSA-cqjg-ppxj-v4xr

Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows…

LOW 16

Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.ph…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01375 Published 2006-04-25 No fix listed

Vulnerabilities

Filters