Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
126 results · page 2 of 3
Jan 28, 2022Piwigo is image gallery software written in PHP.CVE-2016-3735 · Other software · Piwigo · reported by Red HatHigh 8.1
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.CVE-2021-40882 · Other software · Piwigo · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.CVE-2021-40313 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.CVE-2020-22150 · Other software · Piwigo · reported by MITREMedium 6.1
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.CVE-2020-22148 · Other software · Piwigo · reported by MITREMedium 6.1
A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.CVE-2021-32615 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2021show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proCVE-2021-31783 · Other software · Piwigo · reported by MITREHigh 7.5
show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.
- Product
- Localfiles Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.CVE-2021-27973 · Other software · Piwigo · reported by MITREHigh 7.2
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 1, 2020admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.CVE-2014-8945 · Other software · Piwigo · reported by MITRECritical 9.8
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_contCVE-2014-8944 · Other software · Piwigo · reported by MITREMedium 5.4
Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.CVE-2014-8943 · Other software · Piwigo · reported by MITREHigh 8.8
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows CSRF.CVE-2014-8942 · Other software · Piwigo · reported by MITREHigh 8.8
Lexiglot through 2014-11-20 allows CSRF.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.CVE-2014-8941 · Other software · Piwigo · reported by MITRECritical 9.8
Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.CVE-2014-8940 · Other software · Piwigo · reported by MITREMedium 5.3
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request iCVE-2014-8939 · Other software · Piwigo · reported by MITREMedium 5.3
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.CVE-2014-8938 · Other software · Piwigo · reported by MITREHigh 7.8
Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Jun 1, 2020Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.CVE-2014-8937 · Other software · Piwigo · reported by MITREHigh 7.5
Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.
- Product
- Lexiglot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjustanotherhacker.comjustanotherhacker.com
Mar 26, 2020The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the CVE-2020-9468 · Other software · Piwigo · reported by MITREMedium 4.3
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2020Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.CVE-2020-9467 · Other software · Piwigo · reported by MITREMedium 5.4
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 10, 2020Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.CVE-2020-8089 · Other software · Piwigo · reported by MITREMedium 5.4
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2019piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)CVE-2012-4526 · Other software · piwigo · reported by Red HatMedium 6.1
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 2, 2019piwigo has XSS in password.phpCVE-2012-4525 · Other software · piwigo · reported by Red HatMedium 6.1
piwigo has XSS in password.php
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 13, 2019admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter.CVE-2019-13364 · Other software · Piwigo · reported by MITRECritical 9.6
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 13, 2019admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_CVE-2019-13363 · Other software · Piwigo · reported by MITRECritical 9.6
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 16, 2018Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of adminCVE-2014-4613 · Other software · Piwigo · reported by MITREMedium 6.5
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Mar 6, 2018The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request.CVE-2018-7724 · Other software · Piwigo · reported by MITREMedium 5.4
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836.CVE-2018-7723 · Other software · Piwigo · reported by MITREMedium 5.4
The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request.CVE-2018-7722 · Other software · Piwigo · reported by MITREMedium 5.4
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2018ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.CVE-2017-9426 · Other software · Facetag Project · reported by MITRECritical 9.8
ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action.
- Product
- Facetag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtouhidshaikh.comexploit-db.com
Feb 25, 2018The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.CVE-2017-9425 · Other software · Facetag Project · reported by MITREMedium 6.1
The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.
- Product
- Facetag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtouhidshaikh.comexploit-db.com
Feb 24, 2018Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request.CVE-2018-6883 · Other software · Piwigo · reported by MITREMedium 4.9
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Jan 13, 2018Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, and `display` parameters of the `admin.php` file.CVE-2018-5692 · Other software · Piwigo · reported by MITREMedium 6.1
Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, and `display` parameters of the `admin.php` file.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Dec 20, 2017Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit.CVE-2017-17827 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration&CVE-2017-17826 · Other software · Piwigo · reported by MITREMedium 6.1
The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration§ion=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&modeCVE-2017-17825 · Other software · Piwigo · reported by MITREMedium 4.8
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode.CVE-2017-17824 · Other software · Piwigo · reported by MITREMedium 4.9
The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter.CVE-2017-17823 · Other software · Piwigo · reported by MITREMedium 4.9
The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2017The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter.CVE-2017-17822 · Other software · Piwigo · reported by MITREMedium 4.9
The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2017Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.CVE-2017-17775 · Other software · Piwigo · reported by MITREMedium 6.1
Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2017admin/configuration.php in Piwigo 2.9.2 has CSRF.CVE-2017-17774 · Other software · Piwigo · reported by MITREHigh 8.8
admin/configuration.php in Piwigo 2.9.2 has CSRF.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2017The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior.CVE-2017-16893 · Other software · Piwigo · reported by MITREMedium 6.5
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected: values of the edit_list parameters are not sanitized; these are used to construct an SQL query and retrieve a list of registered users into the application.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2017url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " CVE-2016-10514 · Other software · Piwigo · reported by MITREMedium 6.5
url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2017Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.CVE-2016-10513 · Other software · Piwigo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2017SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or catCVE-2017-10682 · Other software · Piwigo · reported by MITRECritical 9.8
SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 29, 2017Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albCVE-2017-10681 · Other software · Piwigo · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 29, 2017Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a pCVE-2017-10680 · Other software · Piwigo · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 29, 2017Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is retCVE-2017-10679 · Other software · Piwigo · reported by MITREHigh 7.5
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 29, 2017Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete perCVE-2017-10678 · Other software · Piwigo · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 24, 2017Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name CVE-2017-9836 · Other software · Piwigo · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name parameter to /admin.php (i.e., creating a virtual album).
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2017An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and condCVE-2017-9464 · Other software · Piwigo · reported by MITREMedium 6.1
An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwizlynxgroup.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.