Vulnerabilities > Piwigo > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-18 | CVE-2022-26267 | Missing Authentication for Critical Function vulnerability in Piwigo 12.2.0 Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. | 7.5 |
| 2022-01-28 | CVE-2016-3735 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Piwigo Piwigo is image gallery software written in PHP. | 8.1 |
| 2021-12-06 | CVE-2021-40313 | SQL Injection vulnerability in Piwigo 11.5.0 Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. | 8.8 |
| 2021-04-26 | CVE-2021-31783 | Insufficient Verification of Data Authenticity vulnerability in Piwigo Localfiles Editor show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check. | 7.5 |
| 2021-04-02 | CVE-2021-27973 | SQL Injection vulnerability in Piwigo SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | 7.2 |
| 2020-06-01 | CVE-2014-8943 | Server-Side Request Forgery (SSRF) vulnerability in Piwigo Lexiglot Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. | 8.8 |
| 2020-06-01 | CVE-2014-8942 | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo Lexiglot Lexiglot through 2014-11-20 allows CSRF. | 8.8 |
| 2020-06-01 | CVE-2014-8938 | Insufficiently Protected Credentials vulnerability in Piwigo Lexiglot Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. | 7.8 |
| 2020-06-01 | CVE-2014-8937 | Resource Exhaustion vulnerability in Piwigo Lexiglot Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. | 7.5 |
| 2017-12-21 | CVE-2017-17827 | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo 2.9.2 Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. | 8.8 |