PT-2026-24982 · Xooscripts · Xoogallery

CVE-2019-25522

·

Publicado

2026-03-12

·

Atualizado

2026-03-12

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions XooGallery (affected versions not specified)
Description The software contains multiple SQL injection flaws that allow unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through the photo id parameter. By sending crafted GET requests to the ''photo.php'' endpoint with malicious photo id values, attackers can extract sensitive data, bypass authentication, or modify database contents.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25522

Produtos afetados

Xoogallery