CVE-2024-29810
EUVD-2024-2680426.03.2024, 16:15
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| 10web | photo_gallery | 𝑥 < 1.8.22 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| 10web | photo_gallery | 1.0.1 ≤ 𝑥 ≤ 1.8.21 | ADP |
References