4images
by 4homepages
CVEs (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-27308 | 0.03 | — | 0.02 | Mar 22, 2021 | A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter. | |||
| CVE-2012-1023 | 0.03 | — | 0.02 | Feb 8, 2012 | Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter. | |||
| CVE-2012-1022 | 0.03 | — | 0.01 | Feb 8, 2012 | SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action. | |||
| CVE-2012-1021 | 0.03 | — | 0.02 | Feb 8, 2012 | Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action. | |||
| CVE-2009-2132 | 0.03 | — | 0.02 | Jun 19, 2009 | Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter. | |||
| CVE-2009-2131 | 0.03 | — | 0.02 | Jun 19, 2009 | Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture. | |||
| CVE-2006-5236 | 0.03 | — | 0.02 | Oct 11, 2006 | SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter. | |||
| CVE-2022-50806 | 0.00 | — | 0.01 | Jan 13, 2026 | 4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific… | |||
| CVE-2015-7708 | 0.00 | — | 0.01 | Oct 5, 2015 | Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php. | |||
| CVE-2009-2380 | 0.00 | — | 0.01 | Jul 8, 2009 | Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable. | |||
| CVE-2006-2011 | 0.00 | — | 0.01 | Apr 25, 2006 | Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.php. |
- CVE-2021-27308Mar 22, 2021risk 0.03cvss —epss 0.02
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
- CVE-2012-1023Feb 8, 2012risk 0.03cvss —epss 0.02
Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter.
- CVE-2012-1022Feb 8, 2012risk 0.03cvss —epss 0.01
SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.
- CVE-2012-1021Feb 8, 2012risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action.
- CVE-2009-2132Jun 19, 2009risk 0.03cvss —epss 0.02
Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.
- CVE-2009-2131Jun 19, 2009risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture.
- CVE-2006-5236Oct 11, 2006risk 0.03cvss —epss 0.02
SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the search_user parameter.
- CVE-2022-50806Jan 13, 2026risk 0.00cvss —epss 0.01
4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific…
- CVE-2015-7708Oct 5, 2015risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.
- CVE-2009-2380Jul 8, 2009risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.
- CVE-2006-2011Apr 25, 2006risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in member.php in 4images 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the nickname, probably involving the user_name parameter in register.php.