CVE-2018-7722

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible...

Cross site request forgery (csrf)

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-$photonumber request. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7722

Piwigo 2.9.3 is affected by CVE-2018-7722 (and related CVEs) where stored XSS is triggered via the name parameter in a /ws.php?format=json request on the management panel. The underlying issue is a stored XSS flaw in the web interface that could be exploited by crafted input to execute script in ...

CVE-2018-7722

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7724

The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-$photonumber request. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7723

The management panel in Piwigo 2.9.3 has stored XSS via the virtualname parameter in a /admin.php?page=catlist request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7724

CVE-2018-7724 affects Piwigo 2.9.3 and is a stored XSS vulnerability in the admin panel via the name parameter in /admin.php?page=photo-${photo_number}. CSRF may be possible (related to CVE-2017-10681). Affected product/version: Piwigo 2.9.3 (and related entries indicate multi-XSS issues before 2...

CVE-2018-7723

CVE-2018-7723 affects Piwigo 2.9.3: a stored XSS in the admin panel via the virtual_name parameter in /admin.php?page=cat_list (distinct from CVE-2017-9836). The description notes CSRF exploitation may be possible, related to CVE-2017-10681. CVSS vectors are provided (3.5/LOW for CVSS2, 5.4/MEDIU...

CVE-2017-9426

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action...

CVE-2017-9426

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action...

Sql injection

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action...

CVE-2017-9425

The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action...

Design/Logic Flaw

The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action...

CVE-2017-9425

The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action...

CVE-2017-9426

ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action...

CVE-2017-9425

The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action...

CVE-2017-9425

The CVE-2017-9425 entry describes an XSS vulnerability in the Facetag extension 0.0.3 for Piwigo, exploitable via the name parameter to ws.php in a facetag.changeTag action. The affected component is the Facetag extension (version 0.0.3) for Piwigo; root cause is reflected in the description of a...

CVE-2017-9426

CVE-2017-9426 affects the Piwigo Facetag extension (version 0.0.3). The ws.php component enables SQL injection via the imageId parameter used by facetag.changeTag and facetag.listTags, as described in the CVE entry. The vulnerability is exploitable over the network with no authentication required...

Piwigo SQL Injection Vulnerability (CNVD-2018-06303)

Piwigo is a free and open source web photo album software. A SQL injection vulnerability exists in admin/tags.php in the admin panel in Piwigo before 2.9.3. An attacker can exploit this vulnerability by using the tags array parameter in the admin.php?page=tags request to perform a SQL injection...

Facetag Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing categories, tags, time, etc. Facetag extension is one of the face tagging plugins. A cross-site scripting vulnerability exists in version 0.0.3 of the Piwigo Facetag...