Yamamah's vulnerability profile centers on a single, narrowly scoped product and clusters around application-layer issues including sensitive information exposure, SQL injection, and path traversal. These weakness classes reflect the input-validation and data-handling demands typical of web-facing applications; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Yamamah over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-2335HIGH SQL injection vulnerability in index.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to execute arbitrary SQL commands via the news param | Jun 18, 2010 | 7.5 | 30 | NO | YES |
CVE-2010-1300HIGH SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter. | Apr 7, 2010 | 7.5 | 30 | NO | YES |
CVE-2010-2336MEDIUM index.php in Yamamah Photo Gallery 1.00 allows remote attackers to obtain the source code of executable files within the web document root via the download parameter. | Jun 18, 2010 | 5.0 | 25 | NO | YES |
CVE-2010-2334MEDIUM Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to read arbitrary files via | Jun 18, 2010 | 5.0 | 25 | NO | YES |
CVE-2011-3823MEDIUM Yamamah 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by | Sep 24, 2011 | 5.0 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Yamamah.
Media articles that mention a CVE ID that affects a product developed by Yamamah — matched by CVE ID, not by vendor name.