Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the `TWG Explorer` item listing. The request method to inject is POST and the attack vector is located on the application-side of the service. The injection point is the add/create input field and the execution point occurs in the item listing after the add or create.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
TinyWebGallery Add/Create模块跨站脚本漏洞
Vulnerability Description
TinyWebGallery（TWG）是软件开发者Michael Dempfle所研发的一套基于Ajax、PHP和XML的开源相册，它提供文字和图片水印、幻灯片播放、图像上传和管理等功能。Add/Create module是其中的一个添加/创建模块。 TWG 2.4版本中的Add/Create模块的‘mkname’、‘mkitem’和‘item’参数存在跨站脚本漏洞。远程攻击者可利用该漏洞向TWG Explorer条目列表中注入恶意的脚本代码。
CVSS Information
N/A
Vulnerability Type
N/A