PT-2023-24958 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 13.7.0 Description: The issue concerns SQL Injection via the Users function. Recommendations: For Piwigo version 13.7.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

CVE-2023-34626

CVE-2023-34626 affects Piwigo 13.7.0 and is a SQL injection vulnerability in the "+Users" function. The connected documents corroborate the impact as SQL injection on Piwigo 13.7.0, but do not provide concrete details on the root cause, specific vulnerable query, affected versions beyond 13.7.0, ...

CVE-2023-34626

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function...

The vulnerability of the user_list_backend.php script in the Piwigo content management system allows attackers to carry out SQL injection attacks.

The vulnerability of the userlistbackend.php script in the Piwigo content management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability allows a malicious actor to carry out attacks based on SQL injections...

SQL Injection in the "Users" function of Piwigo

Description Authenticated admin can perform an SQL injection attack by abusing the "Users" function. Proof of Concept - Log in as an admin and access the 'Users' function. - Observe the request on Burp suite POST /piwigo/ws.php?format=json&method=pwg.users.getList. - Manipulate the 'order' or...

Piwigo <= 14.3.0 CSRF Vulnerability

Piwigo is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo...

Piwigo < 13.7.0 Multiple SQLi Vulnerabilities

Piwigo is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; i...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

CVE-2023-33362

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

Cross site request forgery (csrf)

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

Sql injection

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

Sql injection

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

CVE-2023-33362

Piwigo 13.6.0 is affected by a remote SQL injection in the profile function. The vulnerability (CVE-2023-33362) has CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8). PoCs and public writeups exist (e.g., PACKETSTORM/ExploitsDB). A fix is available in Piwigo 13.7.0 and later; upgrading to 1...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery CSRF in the "add tags" function...

CVE-2023-33359

Piwigo 13.6.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the "add tags" function. The CVE-2023-33359 entry, with CVSS v3.1 base score 4.3 (I=LOW, A=NONE, C=NONE) and user interaction required, indicates a CSRF flaw that could be triggered by an authenticated user without additional pri...

CVE-2023-33362

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

PT-2023-24309 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 13.6.0 Description: The issue is related to SQL Injection via the "/admin/permalinks.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devic...