CVE-2020-19217

SQL Injection vulnerability in admin/batchmanager.php in piwigo v2.9.5, via the filtercategory parameter to admin.php?page=batchmanager...

CVE-2021-40678: Improper Neutralization of Input During Web Page Generation

In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batchmanager&mode=unit...

CVE-2020-19217

SQL Injection vulnerability in admin/batchmanager.php in piwigo v2.9.5, via the filtercategory parameter to admin.php?page=batchmanager...

CVE-2017-17827: Cross-Site Request Forgery (CSRF)

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...

Sql injection

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-1517: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...