GCVE - cpe:2.3:a:4homepages:4images:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:4homepages:4images:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	4Homepages (`97415811-15b1-53db-b5ef-7cf34341cafa`)
Product	4Images (`db309d6f-83d9-5868-b90d-bd8bf2de7388`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-50806`	vulnerable	2026-06-08 05:52:03.615205	4images 1.9 - Remote Command Execution (RCE) HIGH (7.2) 4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter. Published: 2026-01-13T22:51:40.551Z Updated: 2026-04-07T14:06:27.890Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/51147 https://www.4homepages.de/ https://www.vulncheck.com/advisories/images-remote-command-execution-rce	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7708`	vulnerable	2026-06-08 05:07:01.741890	Details available Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php. Published: 2015-10-05T15:00:00.000Z Updated: 2024-09-16T21:07:16.016Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/133712/4images-1.7.11-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Sep/95	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2132`	vulnerable	2026-06-08 04:51:26.833370	Details available Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter. Published: 2009-06-19T17:32:00.000Z Updated: 2024-09-17T03:17:21.399Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35427 http://bbs.wolvez.org/topic/56/ http://www.4homepages.de/forum/index.php?topic=15186.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2131`	vulnerable	2026-06-08 04:51:26.826317	Details available Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture. Published: 2009-06-19T17:32:00.000Z Updated: 2024-08-07T05:36:20.994Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/35342 http://osvdb.org/55092 http://secunia.com/advisories/35427 https://www.exploit-db.com/exploits/8936 https://exchange.xforce.ibmcloud.com/vulnerabilities/51090	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.