Medium severity · published Dec 18, 2025
CVE-2023-53939
TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
TinyWebGallery · TinyWebGallery
2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53939
Product
http://www.tinywebgallery.com/
Exploit
https://www.exploit-db.com/exploits/51442
Third Party Advisory
https://www.vulncheck.com/advisories/tinywebgallery-stored-cross-site-scripting-via-folder-name-parameter
More from TinyWebGallery
9.8
CVE-2023-53922
TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload
7.2
CVE-2012-2931
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file
5.4
CVE-2017-16635
In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module
5.3
CVE-2013-2631
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters…
–
CVE-2012-2932
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter…