Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

CVE-2026-27885 (GCVE-0-2026-27885)

Vulnerability from cvelistv5

Published

2026-04-03 21:36

Modified

2026-04-06 13:15

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72	x_refsource_MISC
	https://piwigo.org/release-16.3.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 16.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27885",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T13:15:11.083389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T13:15:26.353Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T21:36:07.360Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-wfmr-9hg8-jh3m"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/c172d284e11eab4a5dbadd2844d26f734d5c8c72"
        },
        {
          "name": "https://piwigo.org/release-16.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://piwigo.org/release-16.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wfmr-9hg8-jh3m",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo: SQL Injection in Activity.getList"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27885",
    "datePublished": "2026-04-03T21:36:07.360Z",
    "dateReserved": "2026-02-24T15:19:29.716Z",
    "dateUpdated": "2026-04-06T13:15:26.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27834 (GCVE-0-2026-27834)

Vulnerability from cvelistv5

Published

2026-04-03 21:35

Modified

2026-04-06 15:42

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a	x_refsource_MISC
	https://piwigo.org/release-16.3.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 16.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27834",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T15:38:05.554183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T15:42:28.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T21:35:13.966Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-5jwg-cr5q-vjq2"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/9df471f16243371dc3725c5262e1632d23c8218a"
        },
        {
          "name": "https://piwigo.org/release-16.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://piwigo.org/release-16.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5jwg-cr5q-vjq2",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27834",
    "datePublished": "2026-04-03T21:35:13.966Z",
    "dateReserved": "2026-02-24T02:32:39.800Z",
    "dateUpdated": "2026-04-06T15:42:28.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27833 (GCVE-0-2026-27833)

Vulnerability from cvelistv5

Published

2026-04-03 21:34

Modified

2026-04-06 18:55

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Summary

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c	x_refsource_MISC
	https://piwigo.org/release-16.3.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 16.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T18:53:22.756623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T18:55:09.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T21:34:11.425Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/d05c16561ce3692ca922199f8c8d7b1a45893f1c"
        },
        {
          "name": "https://piwigo.org/release-16.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://piwigo.org/release-16.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-397m-gfhm-pmg2",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo: Unauthenticated Information Disclosure via pwg.history.search API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27833",
    "datePublished": "2026-04-03T21:34:11.425Z",
    "dateReserved": "2026-02-24T02:32:39.800Z",
    "dateUpdated": "2026-04-06T18:55:09.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27634 (GCVE-0-2026-27634)

Vulnerability from cvelistv5

Published

2026-04-03 21:33

Modified

2026-04-06 13:13

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-mgqc-3445-qghq	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08	x_refsource_MISC
	https://piwigo.org/release-16.3.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 16.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27634",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-06T13:13:31.839588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-06T13:13:42.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T21:33:13.838Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-mgqc-3445-qghq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-mgqc-3445-qghq"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/0d5ed1f7778bbe263410446d8cf64594df75bd08"
        },
        {
          "name": "https://piwigo.org/release-16.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://piwigo.org/release-16.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mgqc-3445-qghq",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27634",
    "datePublished": "2026-04-03T21:33:13.838Z",
    "dateReserved": "2026-02-20T22:02:30.028Z",
    "dateUpdated": "2026-04-06T13:13:42.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62512 (GCVE-0-2025-62512)

Vulnerability from cvelistv5

Published

2026-02-24 16:43

Modified

2026-02-27 20:52

Severity ?

5.5 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CWE

CWE-204 - Observable Response Discrepancy

Summary

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

References

URL

Tags

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: = 15.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62512",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-27T20:52:21.821693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-27T20:52:30.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "= 15.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204: Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-24T16:43:28.919Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc"
        }
      ],
      "source": {
        "advisory": "GHSA-h4wx-7m83-xfxc",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo Vulnerable to User Enumeration via Password Reset Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62512",
    "datePublished": "2026-02-24T16:43:28.919Z",
    "dateReserved": "2025-10-15T15:03:28.133Z",
    "dateUpdated": "2026-02-27T20:52:30.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-48928 (GCVE-0-2024-48928)

Vulnerability from cvelistv5

Published

2026-02-24 16:39

Modified

2026-02-27 20:52

Severity ?

2.7 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

CWE

CWE-330 - Use of Insufficiently Random Values

Summary

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user's password on top of the secret key. The pwg token uses the user's session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: >= 14.0.0, < 15.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-48928",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-27T20:52:46.711471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-27T20:52:54.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 14.0.0, \u003c 15.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user\u0027s password on top of the secret key. The pwg token uses the user\u0027s session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330: Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-24T16:39:56.944Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8"
        }
      ],
      "source": {
        "advisory": "GHSA-hghg-37rg-7r42",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo\u0027s secret key can be brute forced"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-48928",
    "datePublished": "2026-02-24T16:39:56.944Z",
    "dateReserved": "2024-10-09T22:06:46.174Z",
    "dateUpdated": "2026-02-27T20:52:54.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62406 (GCVE-0-2025-62406)

Vulnerability from cvelistv5

Published

2025-11-18 22:18

Modified

2025-11-19 16:48

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Summary

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: = 15.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62406",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-19T16:13:36.150593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-19T16:48:47.058Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "= 15.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request\u0027s Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-18T22:18:45.747Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692"
        }
      ],
      "source": {
        "advisory": "GHSA-9986-w7jf-33f6",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo is vulnerable to one-click account takeover by modifying the password-reset link"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62406",
    "datePublished": "2025-11-18T22:18:45.747Z",
    "dateReserved": "2025-10-13T16:26:12.178Z",
    "dateUpdated": "2025-11-19T16:48:47.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-44393 (GCVE-0-2023-44393)

Vulnerability from cvelistv5

Published

2023-10-09 14:52

Modified

2024-09-19 13:51

Severity ?

9.3 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Summary

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 14.0.0beta4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:07:32.753Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg"
          },
          {
            "name": "https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "piwigo",
            "vendor": "piwigo",
            "versions": [
              {
                "lessThan": "14.0.0beta4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-44393",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T13:38:37.063877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T13:51:52.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 14.0.0beta4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins\u0026tab=new\u0026installstatus=ok\u0026plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins\u0026tab=new\u0026installstatus=ok\u0026plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-09T14:52:42.879Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23"
        }
      ],
      "source": {
        "advisory": "GHSA-qg85-957m-7vgg",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo Reflected XSS vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-44393",
    "datePublished": "2023-10-09T14:52:42.879Z",
    "dateReserved": "2023-09-28T17:56:32.614Z",
    "dateUpdated": "2024-09-19T13:51:52.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-37270 (GCVE-0-2023-37270)

Vulnerability from cvelistv5

Published

2023-07-07 21:26

Modified

2024-10-18 18:37

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.

References

URL

Tags

	https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx	x_refsource_CONFIRM
	https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a	x_refsource_MISC
	https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491	x_refsource_MISC
	https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621	x_refsource_MISC
	https://piwigo.org/release-13.8.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Piwigo	Piwigo	Version: < 13.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:09:34.105Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx"
          },
          {
            "name": "https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a"
          },
          {
            "name": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491"
          },
          {
            "name": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621"
          },
          {
            "name": "https://piwigo.org/release-13.8.0",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://piwigo.org/release-13.8.0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "piwigo",
            "vendor": "piwigo",
            "versions": [
              {
                "lessThan": "13.8.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-37270",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-18T18:06:38.544954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-18T18:37:52.526Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Piwigo",
          "vendor": "Piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 13.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-07T21:26:28.573Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-934w-qj9p-3qcx"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/commit/978425527d6c113887f845d75cf982bbb62d761a"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/dblayer/functions_mysqli.inc.php#L491"
        },
        {
          "name": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Piwigo/Piwigo/blob/c01ec38bc43f09424a8d404719c35f963d63cf00/include/functions.inc.php#L621"
        },
        {
          "name": "https://piwigo.org/release-13.8.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://piwigo.org/release-13.8.0"
        }
      ],
      "source": {
        "advisory": "GHSA-934w-qj9p-3qcx",
        "discovery": "UNKNOWN"
      },
      "title": "Piwigo SQL Injection vulnerability in \"User-Agent\""
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-37270",
    "datePublished": "2023-07-07T21:26:28.573Z",
    "dateReserved": "2023-06-29T19:35:26.439Z",
    "dateUpdated": "2024-10-18T18:37:52.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-4526 (GCVE-0-2012-4526)

Vulnerability from cvelistv5

Published

2019-12-02 17:48

Modified

2024-08-06 20:42

Severity ?

CWE

in password.php, incomplete fix for CVE-2012-4525

Summary

piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)

References

URL

Tags

	http://www.openwall.com/lists/oss-security/2013/02/11/1	x_refsource_MISC
	https://security-tracker.debian.org/tracker/CVE-2012-4526	x_refsource_MISC
	https://access.redhat.com/security/cve/cve-2012-4526	x_refsource_MISC
	http://www.securityfocus.com/bid/55710	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2012/10/18/4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	piwigo	piwigo	Version: 2.4.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:42:54.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2012-4526"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2012-4526"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55710"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "piwigo",
          "vendor": "piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "in password.php, incomplete fix for CVE-2012-4525",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-02T17:48:45.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2012-4526"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2012-4526"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/55710"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-4526",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "piwigo",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.4.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "piwigo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "in password.php, incomplete fix for CVE-2012-4525"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.openwall.com/lists/oss-security/2013/02/11/1",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2012-4526",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2012-4526"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2012-4526",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2012-4526"
            },
            {
              "name": "http://www.securityfocus.com/bid/55710",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/55710"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2012/10/18/4",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-4526",
    "datePublished": "2019-12-02T17:48:45.000Z",
    "dateReserved": "2012-08-21T00:00:00.000Z",
    "dateUpdated": "2024-08-06T20:42:54.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-4525 (GCVE-0-2012-4525)

Vulnerability from cvelistv5

Published

2019-12-02 17:46

Modified

2024-08-06 20:42

Severity ?

CWE

in password.php

Summary

piwigo has XSS in password.php

References

URL

Tags

	https://security-tracker.debian.org/tracker/CVE-2012-4525	x_refsource_MISC
	https://access.redhat.com/security/cve/cve-2012-4525	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2013/02/11/1	x_refsource_MISC
	http://www.securityfocus.com/bid/55710	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2012/10/18/4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	piwigo	piwigo	Version: 2.4.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:42:53.710Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2012-4525"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2012-4525"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55710"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "piwigo",
          "vendor": "piwigo",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "piwigo has XSS in password.php"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "in password.php",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-02T17:46:59.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2012-4525"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2012-4525"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityfocus.com/bid/55710"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-4525",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "piwigo",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.4.3 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "piwigo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "piwigo has XSS in password.php"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "in password.php"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2012-4525",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2012-4525"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2012-4525",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2012-4525"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2013/02/11/1",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2013/02/11/1"
            },
            {
              "name": "http://www.securityfocus.com/bid/55710",
              "refsource": "MISC",
              "url": "http://www.securityfocus.com/bid/55710"
            },
            {
              "name": "http://www.openwall.com/lists/oss-security/2012/10/18/4",
              "refsource": "MISC",
              "url": "http://www.openwall.com/lists/oss-security/2012/10/18/4"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-4525",
    "datePublished": "2019-12-02T17:46:59.000Z",
    "dateReserved": "2012-08-21T00:00:00.000Z",
    "dateUpdated": "2024-08-06T20:42:53.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2014-000094

Vulnerability from jvndb

Published

2014-08-08 13:57

Modified

2014-08-08 13:57

Severity ?

() - -

Summary

Piwigo vulnerable to SQL injection

Details

Piwigo is a software to manage and host image files on the web. Piwigo contains a SQL injection vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN87962145/index.html
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4649
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-4649
	SQL Injection(CWE-89)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Piwigo

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000094.html",
  "dc:date": "2014-08-08T13:57+09:00",
  "dcterms:issued": "2014-08-08T13:57+09:00",
  "dcterms:modified": "2014-08-08T13:57+09:00",
  "description": "Piwigo is a software to manage and host image files on the web. Piwigo contains a SQL injection vulnerability.\r\n\r\nYuji Tounai of bogus.jp reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000094.html",
  "sec:cpe": {
    "#text": "cpe:/a:piwigo:piwigo",
    "@product": "Piwigo",
    "@vendor": "Piwigo",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000094",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN87962145/index.html",
      "@id": "JVN#87962145",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4649",
      "@id": "CVE-2014-4649",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2014-4649",
      "@id": "CVE-2014-4649",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-89",
      "@title": "SQL Injection(CWE-89)"
    }
  ],
  "title": "Piwigo vulnerable to SQL injection"
}

jvndb-2014-000093

Vulnerability from jvndb

Published

2014-08-08 13:52

Modified

2014-08-19 16:48

Severity ?

() - -

Summary

Piwigo vulnerable to cross-site scripting

Details

Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN09717399/
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3900
	NVD	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3900
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Piwigo

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000093.html",
  "dc:date": "2014-08-19T16:48+09:00",
  "dcterms:issued": "2014-08-08T13:52+09:00",
  "dcterms:modified": "2014-08-19T16:48+09:00",
  "description": "Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability.\r\n\r\nYuji Tounai of bogus.jp reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000093.html",
  "sec:cpe": {
    "#text": "cpe:/a:piwigo:piwigo",
    "@product": "Piwigo",
    "@vendor": "Piwigo",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "2.6",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000093",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN09717399/",
      "@id": "JVN#09717399",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3900",
      "@id": "CVE-2014-3900",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3900",
      "@id": "CVE-2014-3900",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Piwigo vulnerable to cross-site scripting"
}

jvndb-2014-000092

Vulnerability from jvndb

Published

2014-08-08 13:49

Modified

2014-08-15 13:35

Severity ?

() - -

Summary

Piwigo vulnerable to cross-site scripting

Details

Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the "Community" plugin is activated and validation on user uploaded photos is disabled. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN80310172/
	CVE	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1980
	NVD	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1980
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Piwigo

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000092.html",
  "dc:date": "2014-08-15T13:35+09:00",
  "dcterms:issued": "2014-08-08T13:49+09:00",
  "dcterms:modified": "2014-08-15T13:35+09:00",
  "description": "Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the \"Community\" plugin is activated and validation on user uploaded photos is disabled.\r\n\r\nYuji Tounai of bogus.jp reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000092.html",
  "sec:cpe": {
    "#text": "cpe:/a:piwigo:piwigo",
    "@product": "Piwigo",
    "@vendor": "Piwigo",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000092",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN80310172/",
      "@id": "JVN#80310172",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1980",
      "@id": "CVE-2014-1980",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1980",
      "@id": "CVE-2014-1980",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Piwigo vulnerable to cross-site scripting"
}

Refine your search

14 vulnerabilities found for piwigo by piwigo

CVE-2026-27885 (GCVE-0-2026-27885)

Vulnerability from cvelistv5

CVE-2026-27834 (GCVE-0-2026-27834)

Vulnerability from cvelistv5

CVE-2026-27833 (GCVE-0-2026-27833)

Vulnerability from cvelistv5

CVE-2026-27634 (GCVE-0-2026-27634)

Vulnerability from cvelistv5

CVE-2025-62512 (GCVE-0-2025-62512)

Vulnerability from cvelistv5

CVE-2024-48928 (GCVE-0-2024-48928)

Vulnerability from cvelistv5

CVE-2025-62406 (GCVE-0-2025-62406)

Vulnerability from cvelistv5

CVE-2023-44393 (GCVE-0-2023-44393)

Vulnerability from cvelistv5

CVE-2023-37270 (GCVE-0-2023-37270)

Vulnerability from cvelistv5

CVE-2012-4526 (GCVE-0-2012-4526)

Vulnerability from cvelistv5

CVE-2012-4525 (GCVE-0-2012-4525)

Vulnerability from cvelistv5

jvndb-2014-000094

Vulnerability from jvndb

jvndb-2014-000093

Vulnerability from jvndb

jvndb-2014-000092

Vulnerability from jvndb