* * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-45357	79		XSS	2022-02-10	2022-02-15	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.
2	CVE-2021-27973	89		Sql	2021-04-02	2021-04-30	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
3	CVE-2018-6883	89		Sql	2018-02-24	2018-03-17	4.0	None	Remote	Low	???	Partial	None	None
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
4	CVE-2017-16893	89		Sql +Info	2017-12-01	2017-12-19	4.0	None	Remote	Low	???	Partial	None	None
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected: values of the edit_list parameters are not sanitized; these are used to construct an SQL query and retrieve a list of registered users into the application.
5	CVE-2017-10682	89		Exec Code Sql	2017-06-29	2017-12-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
6	CVE-2017-10681	352		CSRF	2017-06-29	2017-07-05	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
7	CVE-2017-10680	352		CSRF	2017-06-29	2017-07-04	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.
8	CVE-2017-10679	200		+Info	2017-06-29	2017-07-06	5.0	None	Remote	Low	Not required	Partial	None	None
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
9	CVE-2017-10678	352		CSRF	2017-06-29	2017-07-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
10	CVE-2017-9464	601			2017-06-14	2017-06-19	5.8	None	Remote	Medium	Not required	Partial	Partial	None
An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. The identification.php component is affected by this issue: the "redirect" parameter is not validated.
11	CVE-2017-9463	89		Sql +Info	2017-06-14	2017-06-19	4.0	None	Remote	Low	???	Partial	None	None
The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The user_list_backend.php component is affected: values of the iDisplayStart & iDisplayLength parameters are not sanitized; these are used to construct a SQL query and retrieve a list of registered users into the application.
12	CVE-2017-9452	79		XSS	2017-06-06	2017-06-09	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
13	CVE-2017-5608	79		XSS	2017-01-28	2017-02-03	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename.
14	CVE-2016-10514	284		Bypass	2017-10-10	2017-11-05	4.3	None	Remote	Medium	Not required	None	Partial	None
url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
15	CVE-2016-10513	79		XSS	2017-10-10	2017-10-20	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
16	CVE-2016-10105	200		Exec Code +Info	2017-01-03	2017-01-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
17	CVE-2016-10085	284		File Inclusion	2016-12-30	2017-01-03	6.5	None	Remote	Low	???	Partial	Partial	Partial
admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.
18	CVE-2016-10084	284		File Inclusion	2016-12-30	2017-01-03	6.5	None	Remote	Low	???	Partial	Partial	Partial
admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
19	CVE-2016-10083	79		XSS	2016-12-30	2017-01-03	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case.
20	CVE-2016-3735	335			2022-01-28	2022-02-02	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
21	CVE-2015-2035	89		Exec Code Sql	2015-02-20	2016-11-30	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php.
22	CVE-2015-2034	79		XSS	2015-02-20	2016-11-30	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php.
23	CVE-2015-1517	89		Exec Code Sql	2015-02-20	2018-10-09	6.0	None	Remote	Medium	???	Partial	Partial	Partial
SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.
24	CVE-2015-1441	89		Exec Code Sql	2015-02-03	2015-02-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
25	CVE-2014-9115	89		Exec Code Sql	2014-12-23	2014-12-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.
26	CVE-2014-4648				2014-06-28	2014-06-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."
27	CVE-2014-4614	352		CSRF	2014-07-02	2014-07-09	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.
28	CVE-2014-3900	79		XSS	2014-08-17	2014-09-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the associate[] field, a different vulnerability than CVE-2014-4649.
29	CVE-2014-1980	79		XSS	2014-08-14	2014-08-14	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.
30	CVE-2013-1469	22	1	Dir. Trav.	2013-03-13	2013-03-19	4.0	None	Remote	High	Not required	Partial	None	Partial
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
31	CVE-2013-1468	352	1	CSRF	2013-03-14	2013-10-03	7.6	None	Remote	High	Not required	Complete	Complete	Complete
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
32	CVE-2012-4526	79		XSS	2019-12-02	2019-12-04	4.3	None	Remote	Medium	Not required	None	Partial	None
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
33	CVE-2012-4525	79		XSS	2019-12-02	2019-12-04	4.3	None	Remote	Medium	Not required	None	Partial	None
piwigo has XSS in password.php
34	CVE-2012-2209	79	1	XSS	2012-08-14	2017-08-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme parameter in the theme module.
35	CVE-2012-2208	22	1	Dir. Trav.	2012-08-14	2017-08-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
36	CVE-2010-1707	79		XSS	2010-05-04	2010-05-04	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Piwigo 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) login and (2) mail_address parameters.
37	CVE-2009-4039	79		XSS	2009-11-20	2009-11-23	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
38	CVE-2009-2933	89		Exec Code Sql	2009-08-21	2018-10-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the items_number parameter.

Total number of vulnerabilities : 38 Page : 1 (This Page)