Cross site request forgery (csrf)

admin.php?page=accountbilling in Piwigo 2.9.5 has XSS via the vatnumber, billingname, company, or billingaddress parameter. This is exploitable via CSRF...

Cross site request forgery (csrf)

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

CVE-2019-13364

Piwigo 2.9.5 is affected by CVE-2019-13364: admin.php?page=account_billing allows XSS through vat_number, billing_name, company, or billing_address, with exploitation possible via CSRF. The underlying issue is improper validation in the affected endpoint. Multiple sources (NVD, Red Hat, CNVD, OSV...

CVE-2019-13364

admin.php?page=accountbilling in Piwigo 2.9.5 has XSS via the vatnumber, billingname, company, or billingaddress parameter. This is exploitable via CSRF...

CVE-2019-13363

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

CVE-2019-13363

CVE-2019-13363 affects Piwigo 2.9.5. The vulnerability is a Cross‑Site Scripting (XSS) in the admin.php?page=notification_by_mail endpoint, exploitable via parameters such as nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_date...

Piwigo 2.9.5 Cross Site Request Forgery / Cross Site Scripting

===== Tempest Security Intelligence - ADV-03/2019 ========================== Piwigo - Version 2.9.5 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timeline ...

PT-2019-13293 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 2.9.5 Description: The issue concerns a Cross-Site Scripting XSS exploit in the admin.php?page=notification by mail endpoint. This exploit is achievable through several parameters: nbm send html mail, nbm send mail as, nbm send...

PT-2019-13294 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 2.9.5 Description: The issue concerns an XSS exploit via the "admin.php?page=account billing" endpoint, specifically through the vat number, billing name, company, or billing address parameters. This is also exploitable through...

CVE-2014-4613

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

CVE-2014-4613

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

CVE-2014-4613

CVE-2014-4613 describes a cross-site request forgery in the Piwigo administration panel prior to 2.6.2. The issue allows remote attackers to hijack administrator sessions by crafting requests to ws.php with a pwg.users.add action to add new users. Affected software: Piwigo versions before 2.6.2. ...

CVE-2014-4613

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

Piwigo < 2.9.4 Multiple XSS Vulnerabilities

Piwigo is prone to multiple stored XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Piwigo cross-site scripting vulnerability (CNVD-2018-06553)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit th...

Piwigo cross-site scripting vulnerability (CNVD-2018-06555)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit th...

Piwigo cross-site scripting vulnerability (CNVD-2018-06554)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit thi...

CVE-2018-7724

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-$photonumber request. CSRF exploitation, related to CVE-2017-10681, may be possible...

Cross site request forgery (csrf)

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-$photonumber request. CSRF exploitation, related to CVE-2017-10681, may be possible...