Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2856▼ 331 respecto a la semana anterior

Críticas / altas1383▼ 38 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)292▼ 217 respecto a la semana anterior

136 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2015-9380	Modificada	Alta (8.8)	0.82%	—	10web Photo Gallery	30/8/2019	17/6/2026	The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
CVE-2019-14798	Modificada	Media (4.9)	4.4%	—	10web Photo Gallery	9/8/2019	17/6/2026	The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
CVE-2019-14797	Modificada	Media (5.4)	1.3%	—	10web Photo Gallery	9/8/2019	17/6/2026	The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
CVE-2019-14313	Modificada	Crítica (9.8)	4.5%	—	10web Photo Gallery	30/7/2019	17/6/2026	A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
CVE-2019-10866	Modificada	Crítica (9.8)	6.2%	💥 Exploit	10web Form Maker	23/5/2019	17/6/2026	In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
CVE-2019-11590	Modificada	Alta (8.8)	1.2%	—	10web Form Maker	29/4/2019	17/6/2026	The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
CVE-2015-2324	Modificada	Media (5.4)	0.86%	—	10web Photo Gallery	19/2/2018	17/6/2026	Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-9312	Modificada	Alta (8.8)	45%	💥 Exploit	10web Photo Gallery	28/8/2017	17/6/2026	Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
CVE-2017-12977	Modificada	Alta (7.2)	1.6%	—	10web Photo Gallery	21/8/2017	17/6/2026	The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
CVE-2015-1393	Modificada	Media (6.5)	1.7%	—	10web Photo Gallery	2/2/2015	17/6/2026	SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
CVE-2015-1055	Modificada	Alta (7.5)	2.1%	—	10web Photo Gallery	16/1/2015	17/6/2026	SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.