CVE-2020-19217

CVE-2020-19217 affects Piwigo 2.9.5. A SQL injection flaw exists in admin/batch_manager.php exploitable via the filter_category parameter, enabling injection through admin.php?page=batch_manager. The issue is caused by unsafely interpolating user-controlled input into SQL queries, as described ac...

CVE-2016-10084

CVE-2016-10084 affects Piwigo <= 2.8.3 where admin/batch_manager.php allows remote authenticated administrators to perform a file inclusion via the $page['tab'] (mode) parameter. This is a remote inclusion risk with impact on confidentiality/integrity/availability as per CVSS. OpenVAS notes Pi...