CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2023-51790
https://notcve.org/view.php?id=CVE-2023-51790
Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component. Vulnerabilidad de Cross Site Scripting en piwigo v.14.0.0 permite a un atacante remoto obtener información confidencial a través del parámetro lang en el componente del complemento Herramientas de Administrador. • https://github.com/Piwigo/AdminTools/issues/21 https://github.com/Piwigo/Piwigo/issues/2069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 1CVE-2023-44393 – Piwigo Reflected XSS vulnerability
https://notcve.org/view.php?id=CVE-2023-44393
Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. • https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23 https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vgg • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •