| CVE-2023-33361 | KRITISCH9.8 | Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. | 23/05/2023 |
| CVE-2023-33359 | MITTEL4.3 | Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. | 23/05/2023 |
| CVE-2023-27233 | HOCH8.8 | Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. | 17/05/2023 |
| CVE-2023-26876 | HOCH8.8 | SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint. | 21/04/2023 |
| CVE-2022-48007 | MITTEL5.4 | A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. | 27/01/2023 |
| CVE-2022-37183 | MITTEL6.1 | Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. | 31/08/2022 |
| CVE-2022-32297 | HOCH7.5 | Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. | 14/07/2022 |
| CVE-2021-40553 | HOCH8.8 | piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. | 28/06/2022 |
| CVE-2021-40678 | MITTEL5.4 | In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit. | 14/06/2022 |
| CVE-2021-40317 | HOCH8.8 | Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. | 26/05/2022 |
| CVE-2020-19217 | HOCH8.8 | SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. | 06/05/2022 |
| CVE-2020-19216 | HOCH8.8 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. | 06/05/2022 |
| CVE-2020-19215 | HOCH8.8 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. | 06/05/2022 |
| CVE-2020-19213 | KRITISCH9.8 | SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. | 06/05/2022 |
| CVE-2020-19212 | MITTEL4.9 | SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. | 06/05/2022 |
| CVE-2022-26267 | HOCH7.5 | Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. | 18/03/2022 |
| CVE-2022-26266 | HOCH8.8 | Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. | 18/03/2022 |
| CVE-2022-24620 | MITTEL5.4 | Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access. | 24/02/2022 |
| CVE-2021-45357 | MITTEL6.1 | Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. | 10/02/2022 |
| CVE-2016-3735 | HOCH8.1 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they kn | 28/01/2022 |