CVE-2026-100698

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-100698: Server-Side Request Forgery (SSRF)

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-39971: Improper Neutralization of CRLF Sequences in HTTP Headers

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $SERVER'HTTPHOST' directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipityisResponseClean is not...

CVE-2021-45357

Cross Site Scripting XSS vulnerability exists in Piwigo 12.x via the pwgactivity function in include/functions.inc.php...

CVE-2021-45357

CVE-2021-45357 describes a cross-site scripting (XSS) vulnerability in Piwigo 12.x exploitable via the pwg_activity function in include/functions.inc.php. Public records in the connected sources confirm the vulnerable component and location, with related OpenVAS entry noting “Piwigo

PT-2022-12332

Name of the Vulnerable Software and Affected Versions Piwigo versions 12.x Description A Cross Site Scripting XSS issue exists via the pwg activity function in include/functions.inc.php. This allows for potential malicious script execution. Recommendations For Piwigo versions 12.x, consider...

PT-2017-7911

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3 Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved via a URL that contains a " character, or a URL beginning with a substring other than the http:// or...

Directory traversal

Directory traversal vulnerability in the usergetprofile function in include/functions.inc.php in Coppermine Photo Gallery CPG 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang part of serialized data in...