1062 matches found
CVE-2017-17824
The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batchmanagerunit.php elementids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database...
CVE-2017-17825
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...
Sql injection
The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/userlistbackend.php sSortDir0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...
CVE-2017-17825
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...
CVE-2017-17826
The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration§ion=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...
Cross site request forgery (csrf)
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...
CVE-2017-17827
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...
CVE-2017-17827
Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...
CVE-2017-17822
The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/userlistbackend.php sSortDir0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...
CVE-2017-17825
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags- array parameters in an admin.php?page=batchmanager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it...
CVE-2017-17823
The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php orderby array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...
CVE-2017-17827
Piwigo 2.9.2 is vulnerable to Cross‑Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. The connected records consistently describe this CSRF issue ...
CVE-2017-17823
The CVE-2017-17823 entry describes a SQL Injection in Piwigo 2.9.2’s Configuration component, exploitable via the admin/configuration.php order_by array parameter. Impact stated: an attacker can access data in the connected MySQL database. The connected records confirm this issue across multiple ...
CVE-2017-17824
The CVE-2017-17824 entry describes a SQL Injection in Piwigo 2.9.2’s Batch Manager component. Specifically, the admin/batch_manager_unit.php element_ids parameter in unit mode can be exploited to access data in the connected MySQL database. Root cause: an unsafely handled parameter likely leads t...
CVE-2017-17822
CVE-2017-17822 affects Piwigo 2.9.2, specifically the List Users API. The vulnerability is a SQL injection in the List Users API component, exploitable via the /admin/user_list_backend.php sSortDir_0 parameter, allowing an attacker to access data in a connected MySQL database. Multiple connected ...
CVE-2017-17826
The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallerytitle parameter in an admin.php?page=configuration§ion=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it...
CVE-2017-17824
The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batchmanagerunit.php elementids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database...
CVE-2017-17826
The CVE-2017-17826 entry concerns Piwigo 2.9.2. The Configuration component is vulnerable to Persistent Cross‑Site Scripting via the gallery_title parameter in admin.php?page=configuration§ion=main. An attacker can hijack a user’s browser and access data stored in it. The NVD description conf...
CVE-2017-17825
The CVE-2017-17825 entry affects Piwigo 2.9.2, specifically the Batch Manager component. The vulnerability is a Persistent Cross-Site Scripting (stored XSS) triggered by tags-* array parameters in the admin.php?page=batch_manager&mode=unit request, which can allow an attacker to hijack a user’s b...