CVE-2008-4645: Phpwebgallery

High severity, CVSS 9.0. EPSS: 7.1% chance of exploitation in the next 30 days.

plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.

Affected products

• Phpwebgallery Phpwebgallery: up to and including 1.7.2; version 1.0 only; version 1.1 only; version 1.2.1 only; version 1.3.0 only; version 1.3.1 only; …

Published 2008-10-22. Last modified 2026-06-16.