CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32297
https://notcve.org/view.php?id=CVE-2022-32297
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. Se ha detectado que Piwigo versión v12.2.0, contiene una vulnerabilidad de inyección SQL por medio de la función Search • https://github.com/sth276/research/blob/main/piwigo_vul/Second-Order%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3735
https://notcve.org/view.php?id=CVE-2016-3735
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset. Piwigo es un software de galería de imágenes escrito en PHP. Cuando no es cumplido un criterio en un host, piwigo usa por defecto mt_rand para generar tokens de restablecimiento de contraseña. • http://piwigo.org/release-2.8.1%2C https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d https://github.com/Piwigo/Piwigo/issues/470%2C • CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2021-27973 – Piwigo 11.3.0 - 'language' SQL
https://notcve.org/view.php?id=CVE-2021-27973
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. Una inyección SQL se presenta en Piwigo versiones anteriores a 11.4.0, por medio del parámetro language en admin.php?page=languages. Piwigo version 11.3.0 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/49818 http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html https://github.com/Piwigo/Piwigo/issues/1352 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9468
https://notcve.org/view.php?id=CVE-2020-9468
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter. El plugin Community versión 2.9.e-beta para Piwigo, permite a usuarios establecer información de imagen sobre imágenes en álbumes para los que no tienen permiso, al manipular el parámetro image_id. • https://github.com/plegall/Piwigo-community/issues/49 https://piwigo.org/ext/extension_view.php?eid=303 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4526
https://notcve.org/view.php?id=CVE-2012-4526
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) piwigo presenta una vulnerabilidad de tipo XSS en el archivo password.php (una solución incompleta para CVE-2012-4525). • http://www.openwall.com/lists/oss-security/2012/10/18/4 http://www.openwall.com/lists/oss-security/2013/02/11/1 http://www.securityfocus.com/bid/55710 https://access.redhat.com/security/cve/cve-2012-4526 https://security-tracker.debian.org/tracker/CVE-2012-4526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •