Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
CVSS Score
8.8
EPSS Score
0.004
Published
2023-05-17
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
CVSS Score
8.8
EPSS Score
0.51
Published
2023-04-21
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
CVSS Score
7.5
EPSS Score
0.005
Published
2022-07-14
A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score
6.1
EPSS Score
0.004
Published
2021-07-21
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score
6.1
EPSS Score
0.004
Published
2021-07-21
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVSS Score
7.2
EPSS Score
0.002
Published
2021-04-02
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVSS Score
5.4
EPSS Score
0.002
Published
2020-03-26
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVSS Score
5.4
EPSS Score
0.004
Published
2020-02-10
Page 2