# Photo Gallery by 10Web – Mobile-Friendly Image Gallery. Every CVE that names Photo Gallery by 10Web – Mobile-Friendly Image Gallery among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter](https://agentprime.io/advisories/CVE-2026-18557.md) `CVE-2026-18557` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter](https://agentprime.io/advisories/CVE-2026-92974.md) `CVE-2026-92974` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-85652.md) `CVE-2026-85652` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-86311.md) `CVE-2026-86311` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.4 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-9829.md) `CVE-2026-9829` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: SQL injection - [Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-7048.md) `CVE-2026-7048` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: SQL injection - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion](https://agentprime.io/advisories/CVE-2026-1036.md) `CVE-2026-1036` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 5.3 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter](https://agentprime.io/advisories/CVE-2025-2269.md) `CVE-2025-2269` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.1 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-9878.md) `CVE-2024-9878` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 4.4 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function](https://agentprime.io/advisories/CVE-2024-5481.md) `CVE-2024-5481` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.8 Medium · Not analysed yet · Published 7 Jun 2024 · Tags: Path traversal - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG](https://agentprime.io/advisories/CVE-2024-5426.md) `CVE-2024-5426` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.4 Medium · Not analysed yet · Published 7 Jun 2024 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG](https://agentprime.io/advisories/CVE-2024-2296.md) `CVE-2024-2296` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 5.5 Medium · Not analysed yet · Published 6 Apr 2024 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename](https://agentprime.io/advisories/CVE-2024-0221.md) `CVE-2024-0221` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Feb 2024 · Tags: Path traversal - [Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget](https://agentprime.io/advisories/CVE-2023-6924.md) `CVE-2023-6924` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 4.4 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site scripting (XSS) - [Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2022-1394.md) `CVE-2022-1394` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 6 Jun 2022 · Tags: Cross-site scripting (XSS) - [Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2022-1282.md) `CVE-2022-1282` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 2 May 2022 · Tags: Cross-site scripting (XSS) - [Photo Gallery < 1.6.3 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2022-1281.md) `CVE-2022-1281` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · EPSS 0.43 · Not analysed yet · Published 2 May 2022 · Tags: SQL injection - [Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2022-0169.md) `CVE-2022-0169` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · EPSS 0.75 · Not analysed yet · Published 14 Mar 2022 · Tags: SQL injection - [Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2021-25041.md) `CVE-2021-25041` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 6 Dec 2021 · Tags: Cross-site scripting (XSS) - [Photo Gallery < 1.5.75 - File Upload Path Traversal](https://agentprime.io/advisories/CVE-2021-24363.md) `CVE-2021-24363` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 16 Aug 2021 · Tags: Path traversal - [Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG](https://agentprime.io/advisories/CVE-2021-24362.md) `CVE-2021-24362` · CVE record: Unknown Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 16 Aug 2021 · Tags: Cross-site scripting (XSS) - [Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title](https://agentprime.io/advisories/CVE-2021-24310.md) `CVE-2021-24310` · CVE record: 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · No CVSS score · Not analysed yet · Published 1 Jun 2021 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .