Vulnerabilities > Piwigo > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-12 | CVE-2023-51790 | Cross-site Scripting vulnerability in Piwigo 14.0.0 Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component. | 6.1 |
| 2023-10-09 | CVE-2023-44393 | Unspecified vulnerability in Piwigo Piwigo is an open source photo gallery application. | 6.1 |
| 2023-06-15 | CVE-2023-34626 | SQL Injection vulnerability in Piwigo Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function. | 4.3 |
| 2023-05-23 | CVE-2023-33359 | Cross-Site Request Forgery (CSRF) vulnerability in Piwigo 13.6.0 Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. | 4.3 |
| 2023-01-27 | CVE-2022-48007 | Cross-site Scripting vulnerability in Piwigo 13.4.0 A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. | 5.4 |
| 2022-08-31 | CVE-2022-37183 | Cross-site Scripting vulnerability in Piwigo 12.3.0 Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. | 6.1 |
| 2022-06-14 | CVE-2021-40678 | Cross-site Scripting vulnerability in Piwigo 11.5.0 In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit. | 5.4 |
| 2022-05-06 | CVE-2020-19212 | SQL Injection vulnerability in Piwigo 2.9.5 SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. | 4.9 |
| 2022-02-24 | CVE-2022-24620 | Cross-site Scripting vulnerability in Piwigo 12.2.0 Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. | 5.4 |
| 2022-02-10 | CVE-2021-45357 | Cross-site Scripting vulnerability in Piwigo 12.0.0/12.1.0 Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. | 6.1 |