CVE-2017-16635 - CVE House
Back to Database
Status published Medium CVE-2017-16635

In TinyWebGallery v2.4, an XSS vulnerability is located in the...

Vulnerability Description

In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the `TWG Explorer` item listing. The request method to inject is POST and the attack vector is located on the application-side of the service. The injection point is the add/create input field and the execution point occurs in the item listing after the add or create.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16635

Credits & Attribution

No credits recorded in the NVD database.

References

More from tinywebgallery

View All →
CVE-2014-5014
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows...
Critical 9.8
CVE-2013-2631
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure...
Medium 5.3
CVE-2012-5347
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via...
High 7.5
CVE-2012-2932
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8...
Medium 4.3
CVE-2012-2931
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated...
High 7.2

Affected Vendor

tinywebgallery

View all reports →

Affected Software

tinywebgallery
Vulnerable Versions:
2.4

Timeline

Official Publish: November 6th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.