CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33362
https://notcve.org/view.php?id=CVE-2023-33362
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. • https://github.com/Piwigo/Piwigo/issues/1911 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27233
https://notcve.org/view.php?id=CVE-2023-27233
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. • https://gist.github.com/renanavs/dcb13bb1cd618ce7eb0c80290b837245 https://github.com/Piwigo/Piwigo/issues/1872 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 1CVE-2023-26876 – Piwigo CVE-2023-26876 Gather Credentials via SQL Injection
https://notcve.org/view.php?id=CVE-2023-26876
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. Piwigo version 13.5.0 suffers from a remote SQL injection vulnerability. • http://packetstormsecurity.com/files/172059/Piwigo-13.5.0-SQL-Injection.html http://seclists.org/fulldisclosure/2023/Apr/13 https://gist.github.com/rodnt/a190d14d1715890d8df19bad58b90693 https://piwigo.com https://www.tempest.com.br https://nvd.nist.gov/vuln/detail/CVE-2023-26876 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-48007
https://notcve.org/view.php?id=CVE-2022-48007
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. Una vulnerabilidad de cross-site scripting (XSS) almacenado en identification.php de Piwigo v13.4.0 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el User-Agent. • https://github.com/Piwigo/Piwigo/issues/1835 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-37183
https://notcve.org/view.php?id=CVE-2022-37183
Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. Piwigo versión 12.3.0, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) por medio de /search/1940/created-monthly-list • https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Piwigo/2022/12.3.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •