Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
126 results · page 1 of 3
Sep 25, 2026Piwigo is a full featured open source photo gallery application for the web.CVE-2026-62262 · Other software · Piwigo · reported by GitHubCritical 9.1
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Piwigo is a full featured open source photo gallery application for the web.CVE-2026-44642 · Other software · Piwigo · reported by GitHubHigh 8.1
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Piwigo is a full featured open source photo gallery application for the web.CVE-2026-42324 · Other software · Piwigo · reported by GitHubHigh 7.2
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Piwigo is a full featured open source photo gallery application for the web.CVE-2026-42323 · Other software · Piwigo · reported by GitHubHigh 7.2
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Piwigo is a full featured open source photo gallery application for the web.CVE-2026-42322 · Other software · Piwigo · reported by GitHubCritical 9.1
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficientCVE-2026-85750 · Other software · Piwigo · reported by GitHubHigh 7.2
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A security vulnerability has been detected in Piwigo up to 16.3.0.CVE-2026-84441 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026A vulnerability has been found in Piwigo 16.3.0.CVE-2026-78187 · Other software · reported by VulDBLow 1.3
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file wiCVE-2026-35048 · Other software · Piwigo · reported by GitHubCritical 9.8
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Piwigo is an open source photo gallery application for the web.CVE-2026-27885 · Other software · Piwigo · reported by GitHubHigh 7.2
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Piwigo is an open source photo gallery application for the web.CVE-2026-27834 · Other software · Piwigo · reported by GitHubHigh 7.2
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Piwigo is an open source photo gallery application for the web.CVE-2026-27833 · Other software · Piwigo · reported by GitHubHigh 7.5
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Piwigo is an open source photo gallery application for the web.CVE-2026-27634 · Other software · Piwigo · reported by GitHubHigh 8.7
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Piwigo is an open source photo gallery application for the web.CVE-2025-62512 · Other software · Piwigo · reported by GitHubMedium 5.5
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Piwigo is an open source photo gallery application for the web.CVE-2024-48928 · Other software · Piwigo · reported by GitHubLow 2.7
Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user's password on top of the secret key. The pwg token uses the user's session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Piwigo is a full featured open source photo gallery application for the web.CVE-2025-62406 · Other software · Piwigo · reported by GitHubHigh 8.1
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.CVE-2024-43018 · Other software · Piwigo · reported by MITREMedium 6.4
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025PiwigoPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.
- Product
- PiwigoPress
- Affected
- up to 2.33
- What to do
- Affects up to 2.33. Update PiwigoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crCVE-2024-52701 · Other software · piwigo · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.CVE-2024-48311 · Other software · piwigo · reported by MITREHigh 8.8
Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2024A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML viCVE-2024-46606 · Other software · piwigo · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Oct 16, 2024A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML viCVE-2024-46605 · Other software · piwigo · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Sep 27, 2024An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injeCVE-2024-46333 · Other software · piwigo · reported by MITREMedium 4.8
An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function.
- Product
- piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.CVE-2024-28662 · Other software · Piwigo · reported by MITREMedium 5.4
A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application.CVE-2024-26450 · Other software · Piwigo · reported by MITREMedium 5.4
An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scripting payload stored within an Admin user's dashboard, executing remote JavaScript. This can be used to upload a new PHP file under an administrator and directly call that file from the victim's instance to connect back to a malicious listener.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-inCVE-2023-51790 · Other software · Piwigo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Piwigo is an open source photo gallery application.CVE-2023-44393 · Other software · Piwigo · reported by GitHubCritical 9.3
Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023Piwigo is open source photo gallery software.CVE-2023-37270 · Other software · Piwigo · reported by GitHubHigh 7.6
Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.CVE-2023-34626 · Other software · Piwigo · reported by MITREMedium 4.3
Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.CVE-2023-33362 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.CVE-2023-33361 · Other software · Piwigo · reported by MITRECritical 9.8
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.CVE-2023-33359 · Other software · Piwigo · reported by MITREMedium 4.3
Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.CVE-2023-27233 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2023SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the adminCVE-2023-26876 · Other software · Piwigo · reported by MITREHigh 8.8
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 27, 2023A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafteCVE-2022-48007 · Other software · Piwigo · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023A vulnerability was found in Piwigo-Guest-Book up to 1.3.0.CVE-2014-125053 · Other software · Piwigo · reported by VulDBMedium 5.5
A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql injection. Upgrading to version 1.3.1 is able to address this issue. The patch is identified as 0cdd1c388edf15089c3a7541cefe7756e560581d. It is recommended to upgrade the affected component. VDB-217582 is the identifier assigned to this vulnerability.
- Product
- Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.CVE-2022-37183 · Other software · Piwigo · reported by MITREMedium 6.1
Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.CVE-2022-32297 · Other software · Piwigo · reported by MITREHigh 7.5
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.CVE-2021-40553 · Other software · Piwigo · reported by MITREHigh 8.8
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.CVE-2021-40678 · Other software · Piwigo · reported by MITREMedium 5.4
In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.CVE-2021-40317 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.CVE-2020-19217 · Other software · Piwigo · reported by MITREHigh 8.8
SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.CVE-2020-19216 · Other software · Piwigo · reported by MITREHigh 8.8
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.CVE-2020-19215 · Other software · Piwigo · reported by MITREHigh 8.8
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.CVE-2020-19213 · Other software · Piwigo · reported by MITRECritical 9.8
SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.CVE-2020-19212 · Other software · Piwigo · reported by MITREMedium 4.9
SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.CVE-2022-26267 · Other software · Piwigo · reported by MITREHigh 7.5
Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.CVE-2022-26266 · Other software · Piwigo · reported by MITREHigh 8.8
Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation.CVE-2022-24620 · Other software · Piwigo · reported by MITREMedium 5.4
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.CVE-2021-45357 · Other software · Piwigo · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.
- Product
- Piwigo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.