Tinywebgallery
Approved changes feed: RSS · Atom
cpe:2.3:a:tinywebgallery:tinywebgallery:2.5:*:*:*:*:*:*:*
part: a version: 2.5 update: *
| Vendor | Tinywebgallery (da544668-331c-5b79-8a65-af2c208dd702) |
|---|---|
| Product | Tinywebgallery (d848f0ce-2f76-5f72-bb27-fca023d539ea) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-53939 |
vulnerable | 2026-06-08 06:19:40.068698 |
TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter
MEDIUM (5.4)
TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.
Published: 2025-12-18T19:53:34.564Z
Updated: 2026-07-15T01:24:56.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-53922 |
vulnerable | 2026-06-08 06:19:40.019278 |
TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload
CRITICAL (9.8)
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
Published: 2025-12-17T22:44:53.801Z
Updated: 2026-07-15T01:24:55.680Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.