CVE-2024-37442

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37442
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.

3.8 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve Third Party Advisory
https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ays-pro:photo_gallery:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 09:23

Type Values Removed Values Added
References () https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve - Third Party Advisory () https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve - Third Party Advisory
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 3.8

29 Aug 2024, 18:49

Type Values Removed Values Added
CPE cpe:2.3:a:ays-pro:photo_gallery:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : 3.8 		v2 : unknown
v3 : 5.5
References () https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve - () https://patchstack.com/database/vulnerability/gallery-photo-gallery/wordpress-photo-gallery-by-ays-responsive-image-gallery-plugin-5-7-1-html-injection-vulnerability?_s_id=cve - Third Party Advisory
First Time Ays-pro
Ays-pro photo Gallery

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) La neutralización incorrecta de elementos especiales en la salida utilizada por una vulnerabilidad de componente posterior ('inyección') en Photo Gallery Team Photo Gallery by Ays permite la inyección de código. Este problema afecta a Photo Gallery by Ays: desde n/a antes de 5.7.1.

09 Jul 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-09 11:15

Updated : 2024-11-21 09:23

NVD link : CVE-2024-37442

Mitre link : CVE-2024-37442

CVE.ORG link : CVE-2024-37442

JSON object : View

Products Affected

ays-pro

  • photo_gallery
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')