Vulnerabilities > Piwigo
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-12 | CVE-2023-51790 | Cross-site Scripting vulnerability in Piwigo 14.0.0 Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component. | 6.1 |
| 2023-10-09 | CVE-2023-44393 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Piwigo Piwigo is an open source photo gallery application. | 6.1 |
| 2023-07-07 | CVE-2023-37270 | SQL Injection vulnerability in Piwigo Piwigo is open source photo gallery software. | 8.8 |
| 2023-06-15 | CVE-2023-34626 | SQL Injection vulnerability in Piwigo Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function. | 4.3 |
| 2023-05-23 | CVE-2023-33359 | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo 13.6.0 Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. | 4.3 |
| 2023-05-23 | CVE-2023-33361 | SQL Injection vulnerability in Piwigo 13.6.0 Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. | 9.8 |
| 2023-05-23 | CVE-2023-33362 | SQL Injection vulnerability in Piwigo 13.6.0 Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. | 9.8 |
| 2023-05-17 | CVE-2023-27233 | SQL Injection vulnerability in Piwigo Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. | 8.8 |
| 2023-04-21 | CVE-2023-26876 | SQL Injection vulnerability in Piwigo SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. | 8.8 |
| 2023-01-27 | CVE-2022-48007 | Cross-site Scripting vulnerability in Piwigo 13.4.0 A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. | 5.4 |