CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33361
https://notcve.org/view.php?id=CVE-2023-33361
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. • https://github.com/Piwigo/Piwigo/issues/1910 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33362
https://notcve.org/view.php?id=CVE-2023-33362
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. • https://github.com/Piwigo/Piwigo/issues/1911 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27233
https://notcve.org/view.php?id=CVE-2023-27233
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. • https://gist.github.com/renanavs/dcb13bb1cd618ce7eb0c80290b837245 https://github.com/Piwigo/Piwigo/issues/1872 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 1CVE-2023-26876 – Piwigo CVE-2023-26876 Gather Credentials via SQL Injection
https://notcve.org/view.php?id=CVE-2023-26876
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. Piwigo version 13.5.0 suffers from a remote SQL injection vulnerability. • http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html http://seclists.org/fulldisclosure/2023/Apr/13 https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 https://piwigo.com https://www.tempest.com.br https://nvd.nist.gov/vuln/detail/CVE-2023-26876 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-48007
https://notcve.org/view.php?id=CVE-2022-48007
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. Una vulnerabilidad de cross-site scripting (XSS) almacenado en identification.php de Piwigo v13.4.0 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el User-Agent. • https://github.com/Piwigo/Piwigo/issues/1835 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •