SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVSS Score
7.2
EPSS Score
0.003
Published
2021-04-02
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVSS Score
5.4
EPSS Score
0.002
Published
2020-03-26
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVSS Score
5.4
EPSS Score
0.004
Published
2020-02-10
Page 2