CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17827
https://notcve.org/view.php?id=CVE-2017-17827
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. Piwigo 2.9.2 es vulnerable a Cross-Site Request Forgery (CSRF) mediante /admin.php? • https://github.com/Piwigo/Piwigo/commit/c3b4c6f7f0ddeaea492080fb8211d7b4cfedaf6f https://github.com/Piwigo/Piwigo/issues/822 https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20Site%20Request%20Forgery%20in%20Piwigo%202.9.2.md • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-17775
https://notcve.org/view.php?id=CVE-2017-17775
Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. Piwigo tiene una vulnerabilidad de Cross-Site Scripting (XSS) mediante el parámetro name en una petición admin.php?page=album-3-properties. • https://github.com/d4wner/Vulnerabilities-Report/blob/master/piwigo.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-17774
https://notcve.org/view.php?id=CVE-2017-17774
admin/configuration.php in Piwigo 2.9.2 has CSRF. admin/configuration.php en Piwigo 2.9.2 tiene una vulnerabilidad Cross-Site Request Forgery (CSRF). • https://github.com/Piwigo/Piwigo/issues/822 https://github.com/d4wner/Vulnerabilities-Report/blob/master/piwigo.md • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16893
https://notcve.org/view.php?id=CVE-2017-16893
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected: values of the edit_list parameters are not sanitized; these are used to construct an SQL query and retrieve a list of registered users into the application. La aplicación Piwigo se ve afectada por una vulnerabilidad de inyección SQL en la versión 2.9.2 y posiblemente en las anteriores. Esta vulnerabilidad permite que los atacantes remotos autenticados obtengan información en el contexto del usuario utilizado por la aplicación para recuperar datos de la base de datos. tags.php se ve afectado: los valores de los parámetros edit_list no están sanitizados; se utilizan para construir una consulta SQL y recuperar una lista de usuarios registrados en la aplicación. • https://github.com/Piwigo/Piwigo/issues/804 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10513
https://notcve.org/view.php?id=CVE-2016-10513
Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php. Existe Cross-Site Scripting (XSS) en Piwigo en versiones anteriores a la 2.8.3 mediante una expresión de búsqueda manipulada en include/functions_search.inc.php. • http://piwigo.org/releases/2.8.3 https://github.com/Piwigo/Piwigo/commit/9a93d1f44b06605af84520509e7a0e8b64ab0c05 https://github.com/Piwigo/Piwigo/issues/548 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •