CVE-2025-0721

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
needyamin	image_gallery	1.0

References

https://vuldb.com/?ctiid.293481Permissions Required, VDB Entry
https://vuldb.com/?id.293481Third Party Advisory, VDB Entry
https://vuldb.com/?submit.482812Third Party Advisory, VDB Entry
https://www.websecurityinsights.my.id/2025/01/imagegallery-viewphpusername-cross-site.htmlExploit, Third Party Advisory

Timeline

Published: Jan 27, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-07227.2A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/CVE-2025-07236.5The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the ri CVE-2025-07248.8The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, an CVE-2025-07257.3When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, *CVE-2025-07267.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially CVE-2025-07277.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subse CVE-2025-07287.5In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subse CVE-2025-07294.3A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some un CVE-2025-07303.7A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown functi CVE-2025-07316.5An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be exe CVE-2025-07324.5A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some un CVE-2025-07334.5A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the libra