Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Plugins360 Subscribe
Filtered by product All-in-one Video Gallery
Total 2 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-2633 1 Plugins360 1 All-in-one Video Gallery 2022-09-12 N/A 8.2 HIGH
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the ~/public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensitive files hosted on the affected server and forge requests to the server.
CVE-2021-24970 1 Plugins360 1 All-in-one Video Gallery 2021-12-16 6.5 MEDIUM 7.2 HIGH
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue