CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2020-19212
https://notcve.org/view.php?id=CVE-2020-19212
SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. Una vulnerabilidad de inyección SQL en el archivo admin/group_list.php en piwigo versión v2.9.5, por medio del parámetro group to delete • https://github.com/Piwigo/Piwigo/issues/1009 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3735
https://notcve.org/view.php?id=CVE-2016-3735
Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset. Piwigo es un software de galería de imágenes escrito en PHP. Cuando no es cumplido un criterio en un host, piwigo usa por defecto mt_rand para generar tokens de restablecimiento de contraseña. • http://piwigo.org/release-2.8.1%2C https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d https://github.com/Piwigo/Piwigo/issues/470%2C • CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22150
https://notcve.org/view.php?id=CVE-2020-22150
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. Una vulnerabilidad de tipo cross site scripting (XSS) en el archivo /admin.php?page=permalinks de Piwigo versión 2.10.1 permite a atacantes ejecutar scripts web o HTML arbitrarios • https://github.com/Piwigo/Piwigo/issues/1158 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22148
https://notcve.org/view.php?id=CVE-2020-22148
A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. Una vulnerabilidad de tipo cross site scripting (XSS) almacenado en el archivo /admin.php?page=tags de Piwigo versión 2.10.1, permite a atacantes ejecutar scripts web o HTML arbitrarios • https://github.com/Piwigo/Piwigo/issues/1157 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2021-27973 – Piwigo 11.3.0 - 'language' SQL
https://notcve.org/view.php?id=CVE-2021-27973
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. Una inyección SQL se presenta en Piwigo versiones anteriores a 11.4.0, por medio del parámetro language en admin.php?page=languages. Piwigo version 11.3.0 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/49818 http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html https://github.com/Piwigo/Piwigo/issues/1352 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •