CVE-2026-49771

HighCVSS 7.6/10Last modified Jul 22, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection.

This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-497729.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Cale CVE-2026-497736.5Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.CVE-2026-497749.9Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue CVE-2026-497756.5Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.CVE-2026-497769.3Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 version CVE-2026-4977710.0Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious So CVE-2026-497787.1Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.CVE-2026-497796.5Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for Woo CVE-2026-49789.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System al CVE-2026-497808.8Customer Privilege Escalation in Dokan <= 5.0.2 versions.CVE-2026-497819.8Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.CVE-2026-497825.4Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security