Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (67 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2012-2208 1 Piwigo 1 Piwigo 2025-04-11 N/A
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVE-2013-1469 1 Piwigo 1 Piwigo 2025-04-11 N/A
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVE-2013-1468 1 Piwigo 1 Piwigo 2025-04-11 N/A
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
CVE-2010-1707 1 Piwigo 1 Piwigo 2025-04-11 N/A
Multiple cross-site scripting (XSS) vulnerabilities in register.php in Piwigo 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) login and (2) mail_address parameters.
CVE-2021-32615 1 Piwigo 1 Piwigo 2024-11-21 9.8 Critical
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVE-2021-27973 1 Piwigo 1 Piwigo 2024-11-21 7.2 High
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVE-2020-9468 1 Piwigo 1 Piwigo 2024-11-21 4.3 Medium
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
CVE-2020-9467 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVE-2020-8089 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVE-2020-22150 1 Piwigo 1 Piwigo 2024-11-21 6.1 Medium
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-22148 1 Piwigo 1 Piwigo 2024-11-21 6.1 Medium
A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-19217 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
CVE-2020-19216 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
CVE-2020-19215 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
CVE-2020-19213 1 Piwigo 1 Piwigo 2024-11-21 9.8 Critical
SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVE-2020-19212 1 Piwigo 1 Piwigo 2024-11-21 4.9 Medium
SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
CVE-2019-13364 1 Piwigo 1 Piwigo 2024-11-21 9.6 Critical
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.
CVE-2019-13363 1 Piwigo 1 Piwigo 2024-11-21 9.6 Critical
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.
CVE-2018-7724 1 Piwigo 1 Piwigo 2024-11-21 N/A
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible.
CVE-2018-7723 1 Piwigo 1 Piwigo 2024-11-21 N/A
The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible.