CVE-2013-2631

MediumCVSS 5.3/10Last modified Jun 16, 2026

Description

TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters "twg_browserx" and "twg_browsery" in the page image.php.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/121128/TinyWebGallery-1.8.9-Path-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.isecauditors.com/advisories-2013#2013-012Exploit, Third Party Advisory
https://packetstormsecurity.com/files/121128/TinyWebGallery-1.8.9-Path-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.isecauditors.com/advisories-2013#2013-012Exploit, Third Party Advisory

Timeline

Published: Feb 3, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-26326.8Google V8 before 3.17.13, as used in Google Chrome before 27.0.1444.3, allows remote attackers to cause a denial of service (application cra CVE-2013-26335.0Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to ob CVE-2013-26341.9net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive inform CVE-2013-26351.9The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which CVE-2013-26361.9net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive in CVE-2013-26376.1A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes CVE-2013-26394.3Cross-site scripting (XSS) vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote attackers to inject CVE-2013-26405.0ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which al CVE-2013-26415.0Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via CVE-2013-26429.3Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip para CVE-2013-26434.3Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web sc CVE-2013-26459.3Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote at