YaPiG 0.92b

CPE Details

YaPiG 0.92b
yapig
yapig
0.92b
2023-12-29
15h41 +00:00
2023-12-29
15h41 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:yapig:yapig:0.92b:*:*:*:*:*:*:*

Informations

Vendor

yapig

Product

yapig

Version

0.92b

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2005-4799 2006-05-15 14h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the Homepage field (aka the Website field) in an "image-related comment" and (2) the img_size field in view.php. NOTE: due to lack of details from the researcher, it is not clear whether the comment vector overlaps CVE-2005-1886.
5.1
CVE-2005-4800 2006-05-15 14h00 +00:00 Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php, which inserts the code into guid_info.php. NOTE: this issue is easier to exploit due to a separate CSRF vulnerability.
9
CVE-2005-4801 2006-05-15 14h00 +00:00 Multiple cross-site request forgery (CSRF) vulnerabilities in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allow remote attackers to perform unauthorized actions as a logged-in user, as demonstrated by tricking the administrator to access a web page that performs a mod_info action in modify_gallery.php.
7.5
CVE-2005-2736 2005-08-29 02h00 +00:00 Cross-site scripting (XSS) vulnerability in YaPig 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via EXIF data, such as the Camera Model Tag.
4.3
CVE-2005-1881 2005-06-07 04h00 +00:00 upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.
7.5
CVE-2005-1883 2005-06-07 04h00 +00:00 global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.
5
CVE-2005-1884 2005-06-07 04h00 +00:00 Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. (dot dot) in the dir parameter.
6.4
CVE-2005-1886 2005-06-07 04h00 +00:00 Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.
4.3
CVE-2005-1885 2005-06-07 02h00 +00:00 view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message.
5