📦

coppermine_photo_gallery

Vendor: coppermine-gallery

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 22 Code Available
Total RCEs 5 Remote Access
Total CVEs 50 Total Indexed
Avg. EPSS 3.84% Exploit Prob.
Latest CVE CVE-2023-53868 Dec 15

Security Vulnerability Index

Page 5 / 5
5.0 CVSS
CVE-2006-1909
Exploit Found

Directory traversal vulnerability in index.php in Coppermine 1.4.4 allows remote attackers to read arbitrary files via a .//./ (modified dot dot slash) in the file parameter, which causes a regular expression to collapse the sequences into standard "../" sequences.

EPSS: 3.62%
5.0 CVSS
CVE-2006-0872

Directory traversal vulnerability in init.inc.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the lang parameter.

EPSS: 2.31%
5.0 CVSS
CVE-2006-0873

Absolute path traversal vulnerability in docs/showdocs.php in Coppermine Photo Gallery 1.4.3 and earlier allows remote attackers to include arbitrary files via the f parameter, and possibly remote files using UNC share pathnames.

EPSS: 1.66%
5.0 CVSS
CVE-2005-3979

relocate_server.php in Coppermine Photo Gallery (CPG) 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request.

EPSS: 1.55%
4.3 CVSS
CVE-2005-2676

Cross-site scripting (XSS) vulnerability in displayimage.php in Coppermine Photo Gallery before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via EXIF data.

EPSS: 1.18%
7.5 CVSS
CVE-2005-1226

Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information.

EPSS: 1.73%
7.5 CVSS
CVE-2005-1225

SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to (1) init.inc.php or (2) zipdownload.php.

EPSS: 1.21%
4.3 CVSS
CVE-2005-1172

Cross-site scripting (XSS) vulnerability in init.inc.php in Coppermine Photo Gallery 1.3.x allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For parameter.

EPSS: 1.18%
5.0 CVSS
CVE-2004-1984

Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) phpinfo.php, (2) addpic.php, (3) config.php, (4) db_input.php, (5) displayecard.php, (6) ecard.php, (7) crop.inc.php, which reveal the full path in a PHP error message.

EPSS: 2.55%
4.3 CVSS
CVE-2004-1985
Exploit Found

Cross-site scripting (XSS) vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPG_URL parameter.

EPSS: 3.91%