| Package | Affected versions | Patched versions |
|---|---|---|
| piwigo | = 2.9.5 |
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free