PT-2025-30023 · WordPress · Balbooa Gallery

Kamil Szczurowski + 1 · Publicado 2025-07-18 · Atualizado 2025-07-18 · CVE-2025-49486

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Balbooa Gallery plugin versions 1.0.0 through 2.4.0

Description A stored cross-site scripting (XSS) issue exists in the Balbooa Gallery plugin for Joomla. Privileged users can store malicious scripts within gallery items.

Recommendations Update Balbooa Gallery plugin to a version later than 2.4.0.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-49486

Produtos afetados

Balbooa Gallery

Referências · 6

• https://extensions.joomla.org/extension/gallery · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-49486 · Nota de Segurança
• https://twitter.com/CVEnew/status/1946153084922503247 · Publicação no Twitter
• https://t.me/cvenotify/129420 · Publicação no Telegram
• https://t.me/cvetracker/28129 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1946175638643040744 · Publicação no Twitter