CVE-2017-17825

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

PT-2017-15032

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows an attacker to perform Cross-Site Request Forgery attacks, potentially coercing an admin user into performing unintended actions. This can be achieved via the...

PT-2017-15030

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue concerns a Persistent Cross Site Scripting vulnerability in the Batch Manager component. This can be exploited via the tags- array parameters in an "admin.php?page=batch manager&mode=unit" request. An...

PT-2017-15031

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue affects the Configuration component, where a Persistent Cross Site Scripting vulnerability exists via the gallery title parameter in an "admin.php?page=configuration&section=main" request. This can be...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14992

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows for XSS via the name parameter in an "admin.php?page=album-3-properties" request. Recommendations For Piwigo version 2.9.2, avoid using the name parameter in the...

WordPress WP-DownloadManager Plugin 1.68.1 arbitrary file upload vulnerability

Vulnerability file: download-add.php Vulnerability code: if ! empty $POST'do' checkadminreferer'wp-downloadmanageradd-file'; // Decide What To Do switch $POST'do' // Add File case 'Add File', 'wp-downloadmanager': $filetype = ! empty $POST'filetype' ? intval $POST'filetype' : 0; switch$filetype...