CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 21/04/2023 |
| CVE-2022-48007 | 中危5.4 | A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. | 27/01/2023 |
| CVE-2014-125053 | 严重9.8 | A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql injection. Upgrading to version 1.3.1 is able to address this i | 06/01/2023 |
| CVE-2022-37183 | 中危6.1 | Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. | 31/08/2022 |
| CVE-2022-32297 | 高危7.5 | Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. | 14/07/2022 |
| CVE-2021-40553 | 高危8.8 | piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. | 28/06/2022 |
| CVE-2021-40678 | 中危5.4 | In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit. | 14/06/2022 |
| CVE-2021-40317 | 高危8.8 | Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. | 26/05/2022 |
| CVE-2020-19217 | 高危8.8 | SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. | 06/05/2022 |
| CVE-2020-19216 | 高危8.8 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. | 06/05/2022 |
| CVE-2020-19215 | 高危8.8 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. | 06/05/2022 |
| CVE-2020-19213 | 严重9.8 | SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. | 06/05/2022 |
| CVE-2020-19212 | 中危4.9 | SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. | 06/05/2022 |
| CVE-2022-26267 | 高危7.5 | Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. | 18/03/2022 |
| CVE-2022-26266 | 高危8.8 | Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. | 18/03/2022 |
| CVE-2022-24620 | 中危5.4 | Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access. | 24/02/2022 |
| CVE-2021-45357 | 中危6.1 | Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. | 10/02/2022 |