PT-2018-18236

Name of the Vulnerable Software and Affected Versions: Piwigo version 2.9.3 Description: The issue concerns a stored XSS in the management panel of the affected software. This occurs via the name parameter in a "/ws.php?format=json" API endpoint. There is a potential for CSRF exploitation...

CVE-2018-7722: Improper Neutralization of Input During Web Page Generation

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible...