Vulnerabilidades do Tinywebgallery Tinywebgallery

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Tinywebgallery Tinywebgallery: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:tinywebgallery:tinywebgallery

CVE-2023-53939 Média · 5.4 CWE-79 18/12/2025

TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.

CVE-2023-53922 Crítica · 9.8 CWE-434 17/12/2025

TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.