Minigal Nano
Approved changes feed: RSS · Atom
cpe:2.3:a:minigal:minigal_nano:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Minigal (1da52293-299d-5b04-8c01-ae99641146b8) |
|---|---|
| Product | Minigal Nano (87275a85-d19b-5ae4-9c21-64e8cad2b599) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25869 |
vulnerable | 2026-06-08 07:53:20.552425 |
MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter
MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit this behavior to cause the application to enumerate and display image files from unintended filesystem locations that are readable by the web server, resulting in unintended information disclosure.
Published: 2026-02-11T15:40:29.510Z
Updated: 2026-07-14T15:53:55.613Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25868 |
vulnerable | 2026-06-08 07:53:20.550184 |
MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application.
Published: 2026-02-11T15:34:45.776Z
Updated: 2026-07-14T15:53:54.931Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.