Browse CVEs

HIGH 8.8 CVE-2020-19216 SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. Piwigo No fix yet Fix from $1,9502022-05-06 HIGH 8.8 CVE-2020-19217 SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. Piwigo No fix yet Fix from $1,9502022-05-06 HIGH 8.8 CVE-2022-26266 Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. Piwigo No fix yet Fix from $1,9502022-03-18 HIGH 7.5 CVE-2022-26267 Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. Piwigo No fix yet Fix from $1,9502022-03-18 MEDIUM 5.4 CVE-2022-24620 Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmas… Piwigo No fix yet Fix from $1,6002022-02-24 MEDIUM 6.1 CVE-2021-45357 Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. Piwigo after 12.1.0 Fix from $1,6002022-02-10 HIGH 8.1 CVE-2016-3735 Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password … Piwigo 2.8.1+ Fix from $1,9502022-01-28 MEDIUM 6.1 CVE-2021-40882 A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location. Piwigo No fix yet Fix from $1,6002021-12-14 HIGH 8.8 CVE-2021-40313 Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. Piwigo No fix yet Fix from $1,9502021-12-06 MEDIUM 6.1 CVE-2020-22148 A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. Piwigo No fix yet Fix from $1,6002021-07-21 MEDIUM 6.1 CVE-2020-22150 A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. Piwigo No fix yet Fix from $1,6002021-07-21 CRITICAL 9.8 CVE-2021-32615 Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. Piwigo Patch available Fix from $2,3002021-05-13 HIGH 7.5 CVE-2021-31783 show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated… Localfiles Editor 11.4.0.1+ Fix from $1,9502021-04-26 HIGH 7.2 CVE-2021-27973EPSS 11% SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. Piwigo 11.4.0+ Fix from $1,9502021-04-02 CRITICAL 9.8 CVE-2014-8941 Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. Lexiglot after 2014-11-20 Fix from $2,3002020-06-01 CRITICAL 9.8 CVE-2014-8945 admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. Lexiglot after 2014-11-20 Fix from $2,3002020-06-01 HIGH 8.8 CVE-2014-8942 Lexiglot through 2014-11-20 allows CSRF. Lexiglot after 2014-11-20 Fix from $1,9502020-06-01 HIGH 8.8 CVE-2014-8943 Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. Lexiglot after 2014-11-20 Fix from $1,9502020-06-01 HIGH 7.8 CVE-2014-8938 Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the comm… Lexiglot after 2014-11-20 Fix from $1,9502020-06-01 HIGH 7.5 CVE-2014-8937 Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. Lexiglot after 2014-11-20 Fix from $1,9502020-06-01 MEDIUM 5.4 CVE-2014-8944 Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or ne… Lexiglot after 2014-11-20 Fix from $1,6002020-06-01 MEDIUM 5.3 CVE-2014-8939 Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.ph… Lexiglot after 2014-11-20 Fix from $1,6002020-06-01 MEDIUM 5.3 CVE-2014-8940 Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. Lexiglot after 2014-11-20 Fix from $1,6002020-06-01 MEDIUM 5.4 CVE-2020-9467EPSS 24% Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function. Piwigo Patch available Fix from $1,6002020-03-26 MEDIUM 5.4 CVE-2020-8089 Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page. Piwigo No fix yet Fix from $1,6002020-02-10 MEDIUM 6.1 CVE-2012-4525 piwigo has XSS in password.php Piwigo after 2.4.3 Fix from $1,6002019-12-02 MEDIUM 6.1 CVE-2012-4526 piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) Piwigo after 2.4.3 Fix from $1,6002019-12-02 CRITICAL 9.6 CVE-2019-13363 admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_de… Piwigo No fix yet Fix from $2,3002019-09-13 CRITICAL 9.6 CVE-2019-13364 admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is e… Piwigo No fix yet Fix from $2,3002019-09-13 MEDIUM 6.5 CVE-2014-4613 Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authenticati… Piwigo 2.6.2+ Fix from $1,6002018-03-16