CVE-2017-17826

The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17825: Improper Neutralization of Input During Web Page Generation

The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

CVE-2017-17827: Cross-Site Request Forgery (CSRF)

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...

CVE-2017-17826: Improper Neutralization of Input During Web Page Generation

The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...

PT-2017-15032

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows an attacker to perform Cross-Site Request Forgery attacks, potentially coercing an admin user into performing unintended actions. This can be achieved via the...

PT-2017-15031

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue affects the Configuration component, where a Persistent Cross Site Scripting vulnerability exists via the gallery title parameter in an "admin.php?page=configuration&section=main" request. This can be...

PT-2017-15030

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue concerns a Persistent Cross Site Scripting vulnerability in the Batch Manager component. This can be exploited via the tags- array parameters in an "admin.php?page=batch manager&mode=unit" request. An...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14992

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows for XSS via the name parameter in an "admin.php?page=album-3-properties" request. Recommendations For Piwigo version 2.9.2, avoid using the name parameter in the...

CVE-2017-17780: Improper Neutralization of Input During Web Page Generation

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...

CVE-2017-17775: Improper Neutralization of Input During Web Page Generation

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14997

Name of the Vulnerable Software and Affected Versions Clockwork Free and Paid SMS Notifications versions 2.0.3 Two-Factor Authentication - Clockwork SMS version 1.0.2 Booking Calendar - Clockwork SMS version 1.0.5 Contact Form 7 - Clockwork SMS version 2.3.0 Fast Secure Contact Form - Clockwork S...

Cross site scripting

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

CVE-2017-16904

The CVE concerns LvyeCMS (admin.php, Public tologin) up to version 3.1 where a crafted username enables cross-site scripting. The underlying cause is mishandling of the username during admin log viewing, allowing an attacker to inject Web script/HTML that is executed in an administrator’s view. S...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

PT-2017-14631

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1 Description The issue concerns the Public tologin feature in admin.php, which allows for XSS attacks through a crafted username that is mishandled during later log viewing by an administrator. Recommendations For...