CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32297
https://notcve.org/view.php?id=CVE-2022-32297
Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. Se ha detectado que Piwigo versión v12.2.0, contiene una vulnerabilidad de inyección SQL por medio de la función Search • https://github.com/sth276/research/blob/main/piwigo_vul/Second-Order%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2021-27973 – Piwigo 11.3.0 - 'language' SQL
https://notcve.org/view.php?id=CVE-2021-27973
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. Una inyección SQL se presenta en Piwigo versiones anteriores a 11.4.0, por medio del parámetro language en admin.php?page=languages. Piwigo version 11.3.0 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/49818 http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html https://github.com/Piwigo/Piwigo/issues/1352 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7723
https://notcve.org/view.php?id=CVE-2018-7723
The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible. El panel de gestión en Piwigo 2.9.3 tiene Cross-Site Scripting (XSS) persistente mediante el parámetro virtual_name en una petición /admin.php?page=cat_list. • https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7724
https://notcve.org/view.php?id=CVE-2018-7724
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible. El panel de gestión en Piwigo 2.9.3 tiene Cross-Site Scripting (XSS) persistente mediante el parámetro name en una petición /admin.php?page=photo-${photo_number}. • https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7722
https://notcve.org/view.php?id=CVE-2018-7722
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible. El panel de gestión en Piwigo 2.9.3 tiene Cross-Site Scripting (XSS) persistente mediante el parámetro name en una petición /ws.php?format=json. • https://github.com/summ3rf/Vulner/blob/master/Piwigo%20Store%20XSS.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •