TI
Vendor
TinyWebGallery
23
CVEs
0
On KEV
0
New 30D
Products
TI9.8
TinyWebGallery
TinyWebGallery
13 CVEs0 on KEV0 new
AI6.1
Advanced Iframe
Tinywebgallery
9 CVEs0 on KEV0 new
WF9.8
Wordpress Flash Uploader
Tinywebgallery
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-53939 | TI TinyWebGallery TinyWebGallery | 5.4 | Dec 18 | TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter |
| CVE-2023-53922 | TI TinyWebGallery TinyWebGallery | 9.8 | Dec 17 | TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload |
| CVE-2025-1440 | AI Advanced Iframe Tinywebgallery | 5.3 | Mar 26 | Advanced iFrame <= 2024.5 - Unauthenticated Settings Update |
| CVE-2025-1437 | AI Advanced Iframe Tinywebgallery | 5.4 | Mar 26 | Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2025-1439 | AI Advanced Iframe Tinywebgallery | 5.4 | Mar 26 | Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header |
| CVE-2024-1341 | AI Advanced Iframe Tinywebgallery | 5.4 | Feb 29 | Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-24870 | AI Advanced Iframe Tinywebgallery | 5.4 | Feb 5 | WordPress Advanced iFrame Plugin <= 2023.10 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-51690 | AI Advanced Iframe Tinywebgallery | 5.4 | Feb 1 | WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-7069 | AI Advanced Iframe Tinywebgallery | 5.4 | Feb 1 | Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2023-4775 | AI Advanced Iframe Tinywebgallery | 5.4 | Nov 13 | Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2021-24953 | AI Advanced Iframe Tinywebgallery | 6.1 | Mar 7 | The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected… |
| CVE-2013-2631 | TI Tinywebgallery Tinywebgallery | 5.3 | Feb 3 | TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters… |
| CVE-2012-2931 | TI Tinywebgallery Tinywebgallery | 7.2 | Jan 9 | PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file |
| CVE-2014-5014 | WF Wordpress Flash Uploader Tinywebgallery | 9.8 | Apr 25 | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path |
| CVE-2017-16635 | TI Tinywebgallery Tinywebgallery | 5.4 | Nov 6 | In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module |
| CVE-2012-2932 | TI Tinywebgallery Tinywebgallery | – | Apr 24 | Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter… |
| CVE-2012-2930 | TI Tinywebgallery Tinywebgallery | – | Apr 24 | Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests… |
| CVE-2012-5347 | TI Tinywebgallery Tinywebgallery | – | Oct 9 | TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php |
| CVE-2011-3810 | TI Tinywebgallery Tinywebgallery | – | Sep 24 | TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… |
| CVE-2009-1911 | TI Tinywebgallery Tinywebgallery | – | Jun 4 | Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows… |
| CVE-2007-4958 | TI Tinywebgallery Tinywebgallery | – | Sep 18 | Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) index.php,… |
| CVE-2006-4166 | TI Tinywebgallery Tinywebgallery | – | Aug 16 | PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the image parameter to (1) image.php… |
| CVE-2006-1802 | TI Tinywebgallery Tinywebgallery | – | Apr 18 | Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the twg_album parameter |