Description
Multiple vulnerabilities exist in PhpWebGallery 1.3.4, including cross-site scripting (XSS) and local file inclusion (LFI). Input parameters are not properly sanitized before being used in HTML output and file operations.
Impact
XSS allows attackers to execute malicious JavaScript in other users' browsers. LFI allows reading arbitrary files from the server, potentially exposing configuration files with database credentials and other sensitive data.
Solution
Upgrade to Piwigo (the successor to PhpWebGallery) or apply available security patches.