Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (78 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2011-3790 1 Piwigo 1 Piwigo 2025-04-11 N/A
Piwigo 2.1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/metadata.php and certain other files.
CVE-2012-2208 1 Piwigo 1 Piwigo 2025-04-11 N/A
Directory traversal vulnerability in upgrade.php in Piwigo before 2.3.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVE-2012-2209 1 Piwigo 1 Piwigo 2025-04-11 N/A
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme parameter in the theme module.
CVE-2013-1469 1 Piwigo 1 Piwigo 2025-04-11 N/A
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVE-2021-32615 1 Piwigo 1 Piwigo 2024-11-21 9.8 Critical
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVE-2021-31783 1 Piwigo 1 Localfiles Editor 2024-11-21 7.5 High
show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.
CVE-2021-27973 1 Piwigo 1 Piwigo 2024-11-21 7.2 High
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVE-2020-9468 1 Piwigo 1 Piwigo 2024-11-21 4.3 Medium
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
CVE-2020-9467 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVE-2020-8089 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVE-2020-22150 1 Piwigo 1 Piwigo 2024-11-21 6.1 Medium
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-22148 1 Piwigo 1 Piwigo 2024-11-21 6.1 Medium
A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-19217 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
CVE-2020-19216 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
CVE-2020-19215 1 Piwigo 1 Piwigo 2024-11-21 8.8 High
SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
CVE-2020-19213 1 Piwigo 1 Piwigo 2024-11-21 9.8 Critical
SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVE-2020-19212 1 Piwigo 1 Piwigo 2024-11-21 4.9 Medium
SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
CVE-2019-13364 1 Piwigo 1 Piwigo 2024-11-21 9.6 Critical
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.
CVE-2019-13363 1 Piwigo 1 Piwigo 2024-11-21 9.6 Critical
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.
CVE-2018-7724 1 Piwigo 1 Piwigo 2024-11-21 N/A
The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CVE-2017-10681, may be possible.