| CVE-2016-3735 | 高8.1 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they kn | 28/01/2022 |
| CVE-2021-40882 | 中6.1 | A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location. | 14/12/2021 |
| CVE-2021-40313 | 高8.8 | Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. | 06/12/2021 |
| CVE-2020-22150 | 中6.1 | A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. | 21/07/2021 |
| CVE-2020-22148 | 中6.1 | A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. | 21/07/2021 |
| CVE-2021-32615 | 緊急9.8 | Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. | 13/05/2021 |
| CVE-2021-31783 | 高7.5 | show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check. | 26/04/2021 |
| CVE-2021-27973 | 高7.2 | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | 02/04/2021 |
| CVE-2014-8945 | 緊急9.8 | admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. | 01/06/2020 |
| CVE-2014-8944 | 中5.4 | Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter. | 01/06/2020 |
| CVE-2014-8943 | 高8.8 | Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. | 01/06/2020 |
| CVE-2014-8942 | 高8.8 | Lexiglot through 2014-11-20 allows CSRF. | 01/06/2020 |
| CVE-2014-8941 | 緊急9.8 | Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. | 01/06/2020 |
| CVE-2014-8940 | 中5.3 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. | 01/06/2020 |
| CVE-2014-8939 | 中5.3 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages. | 01/06/2020 |
| CVE-2014-8938 | 高7.8 | Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. | 01/06/2020 |
| CVE-2014-8937 | 高7.5 | Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. | 01/06/2020 |
| CVE-2020-9468 | 中4.3 | The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter. | 26/03/2020 |
| CVE-2020-9467 | 中5.4 | Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function. | 26/03/2020 |
| CVE-2020-8089 | 中5.4 | Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page. | 10/02/2020 |