Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
CVSS Score
8.8
EPSS Score
0.004
Published
2023-05-17
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.
CVSS Score
8.8
EPSS Score
0.51
Published
2023-04-21
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
CVSS Score
7.5
EPSS Score
0.005
Published
2022-07-14
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
CVSS Score
8.8
EPSS Score
0.031
Published
2022-06-28
In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.
CVSS Score
5.4
EPSS Score
0.002
Published
2022-06-14
Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
CVSS Score
8.8
EPSS Score
0.003
Published
2022-05-26
A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
CVSS Score
6.1
EPSS Score
0.003
Published
2021-12-14
Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
CVSS Score
8.8
EPSS Score
0.003
Published
2021-12-06
Page 2