Advisories · Technology
contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe.
Every CVE that names contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Unrestricted file upload
- CVSS 6.5 Medium
Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- SQL injection
- CVSS 8.8 High
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Privilege escalation
- CVSS 7.5 High
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- SQL injection
- CVSS 8.1 High
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Authentication bypass
- CVSS 7.5 High
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- SQL injection
- CVSS 5.3 Medium
Contest Gallery <= 28.0.2 - Missing Authorization
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Broken access control
- CVSS 4.3 Medium
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Other injection
- CVSS 6.4 Medium
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Cross-site scripting (XSS)
- CVSS 7.2 High
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scr…
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Cross-site scripting (XSS)
- CVSS 7.2 High
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection
- contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- SQL injection