CVE-2019-13364: Improper Neutralization of Input During Web Page Generation

admin.php?page=accountbilling in Piwigo 2.9.5 has XSS via the vatnumber, billingname, company, or billingaddress parameter. This is exploitable via CSRF...