CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

Piwigo SQL注入漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 13.7.0, which stems from vulnerability to SQL injection attacks via the sers functio...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

The vulnerability of the user_list_backend.php script in the Piwigo content management system allows attackers to carry out SQL injection attacks.

The vulnerability of the userlistbackend.php script in the Piwigo content management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability allows a malicious actor to carry out attacks based on SQL injections...

SQL Injection in the "Users" function of Piwigo

Description Authenticated admin can perform an SQL injection attack by abusing the "Users" function. Proof of Concept - Log in as an admin and access the 'Users' function. - Observe the request on Burp suite POST /piwigo/ws.php?format=json&method=pwg.users.getList. - Manipulate the 'order' or...

Piwigo <= 14.3.0 CSRF Vulnerability

Piwigo is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo...

Piwigo < 13.7.0 Multiple SQLi Vulnerabilities

Piwigo is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; i...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

CVE-2023-33362

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

Cross site request forgery (csrf)

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

Sql injection

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

Sql injection

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

CVE-2023-33362

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the "add tags" function. The CVE-2023-33359 entry, with CVSS v3.1 base score 4.3 (I=LOW, A=NONE, C=NONE) and user interaction required, indicates a CSRF flaw that could be triggered by an authenticated user without additional pri...

CVE-2023-33362

Piwigo 13.6.0 is affected by a remote SQL injection in the profile function. The vulnerability (CVE-2023-33362) has CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8). PoCs and public writeups exist (e.g., PACKETSTORM/ExploitsDB). A fix is available in Piwigo 13.7.0 and later; upgrading to 1...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

Piwigo SQL注入漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 13.6.0, which stems from a problem with the configuration file functionality and can...