Tinywebgallery vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Tinywebgallery products: 2 record(s), with severity, exploitation and fixes.

Tinywebgallery 2

Exploited only (KEV) →

CVE-2023-53939 Medium · 5.4 CWE-79 Dec 18, 2025

TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.

CVE-2023-53922 Critical · 9.8 CWE-434 Dec 17, 2025

TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.