Tinywebgallery
Approved changes feed: RSS · Atom
cpe:2.3:a:tinywebgallery:tinywebgallery:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Tinywebgallery (da544668-331c-5b79-8a65-af2c208dd702) |
|---|---|
| Product | Tinywebgallery (d848f0ce-2f76-5f72-bb27-fca023d539ea) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-53939 |
vulnerable | 2026-06-08 06:19:40.068654 |
TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter
MEDIUM (5.4)
TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.
Published: 2025-12-18T19:53:34.564Z
Updated: 2026-07-15T01:24:56.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53922 |
vulnerable | 2026-06-08 06:19:40.018007 |
TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload
CRITICAL (9.8)
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
Published: 2025-12-17T22:44:53.801Z
Updated: 2026-07-15T01:24:55.680Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-2631 |
vulnerable | 2026-06-08 05:04:27.128327 |
Details available
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twg_browserx" and "twg_browsery" in the page image.php.
Published: 2020-02-03T14:46:45.000Z
Updated: 2024-08-06T15:44:32.648Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2932 |
vulnerable | 2026-06-08 05:02:07.286670 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter in a (1) copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/index.php.
Published: 2015-04-24T14:00:00.000Z
Updated: 2024-08-06T19:50:04.807Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2931 |
vulnerable | 2026-06-08 05:02:07.286354 |
Details available
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file.
Published: 2020-01-09T20:56:12.000Z
Updated: 2024-08-06T19:50:05.082Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2930 |
vulnerable | 2026-06-08 05:02:07.285959 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-1911 |
vulnerable | 2026-06-08 04:51:25.660347 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-4166 |
vulnerable | 2026-06-08 04:49:11.142818 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.