High
CVE-2026-94123
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 57
Reset filters
High
CVE-2026-81650
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2026-81652
NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Low
CVE-2026-81653
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Low
CVE-2026-81651
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
Medium
CVE-2026-81654
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
High
CVE-2026-28141
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-9059
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2026-6566
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
High
CVE-2026-1463
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
High
CVE-2025-13641
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'
Medium
CVE-2025-53224
NextGEN Gallery Search <= 2.12 - Reflected Cross-Site Scripting
High
CVE-2025-7641
Assistant for NextGEN Gallery <= 1.0.9 - Unauthenticated Arbitrary Directory Deletion
Medium
CVE-2025-2537
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Medium
CVE-2024-5878
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
Medium
CVE-2025-28869
NextGEN Gallery Voting <= 2.7.6 - Reflected Cross-Site Scripting
Medium
CVE-2024-10545
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-5020
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
Medium
CVE-2024-6393
NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-39627
NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-5442
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery
Medium
CVE-2024-2744
Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-3097
WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
Medium
CVE-2023-48328
NextGEN Gallery <= 3.37 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.