Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
CVSS Score
8.8
EPSS Score
0.004
Published
2023-05-17
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
CVSS Score
8.8
EPSS Score
0.51
Published
2023-04-21
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
CVSS Score
7.5
EPSS Score
0.005
Published
2022-07-14
SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
CVSS Score
4.9
EPSS Score
0.003
Published
2022-05-06
SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVSS Score
9.8
EPSS Score
0.014
Published
2022-05-06
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
CVSS Score
8.8
EPSS Score
0.003
Published
2022-05-06
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
CVSS Score
8.8
EPSS Score
0.003
Published
2022-05-06
SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
CVSS Score
8.8
EPSS Score
0.002
Published
2022-05-06
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVSS Score
7.2
EPSS Score
0.002
Published
2021-04-02
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.
CVSS Score
9.6
EPSS Score
0.004
Published
2019-09-13