CVE-2017-17823

The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php orderby array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...

CVE-2017-17827

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...

CVE-2017-17827

Piwigo 2.9.2 is vulnerable to Cross‑Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. The connected records consistently describe this CSRF issue ...

CVE-2017-17826

The CVE-2017-17826 entry concerns Piwigo 2.9.2. The Configuration component is vulnerable to Persistent Cross‑Site Scripting via the gallery_title parameter in admin.php?page=configuration&section=main. An attacker can hijack a user’s browser and access data stored in it. The NVD description conf...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

Cross site request forgery (csrf)

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

Cross site request forgery (csrf)

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17774

admin/configuration.php in Piwigo 2.9.2 has CSRF...

CVE-2017-17774

CVE-2017-17774 affects Piwigo 2.9.2, specifically the admin/configuration.php CSRF vulnerability. Root cause: cross-site request forgery in the configuration handler. Impact: could allow a remote attacker to perform unauthorized operations via forged requests if a user is authenticated, per the p...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

Piwigo 'name' Parameter Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site scripting vulnerability exists in Piwigo version 2.9.2. A remote...

Piwigo admin/configuration.php file cross-site request forgery vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site request forgery vulnerability exists in the admin/configuration.php...

Piwigo 2.9.1 SQL Injection

Exploit Title: Piwigo = 2.9.1 - 'cattrue'/'catfalse' SQL Injection Dork: N/A Date: 12.12.2017 Vendor Homepage: http://piwigo.org/ Software Link: http://piwigo.org/basics/downloads Version: = 2.9.1 Category: Webapps Tested on: WiN7x64/WIN10X64 CVE: CVE-2017-10682 Exploit Author: Akityo Email:...

Piwigo 2.9.1 - cat_true cat_false SQL Injection

Piwigo 2.9.1 - cattrue catfalse SQL Injection Exploit Title: Piwigo = 2.9.1 - 'cattrue'/'catfalse' SQL Injection Dork: N/A Date: 12.12.2017 Vendor Homepage: http://piwigo.org/ Software Link: http://piwigo.org/basics/downloads Version: = 2.9.1 Category: Webapps Tested on: WiN7x64/WIN10X64 CVE:...