Contest-Gallery vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20242
3. 20257
4. 20266

Newest CVEs

• CVE-2026-78088

  Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High8.8
• CVE-2026-16586

  Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  Medium6.5
• CVE-2026-12165

  Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High8.8
• CVE-2026-8912

  Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High7.5
• CVE-2026-4021

  Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High8.1
• CVE-2026-3180

  Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High7.5
• CVE-2025-12849

  Contest Gallery <= 28.0.2 - Missing Authorization

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  Medium5.3
• CVE-2025-11254

  Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  Medium4.3
• CVE-2025-10383

  Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  Medium6.4
• CVE-2025-7725

  Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting

  contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

  High7.2