CVE-2017-10679

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request...

Design/Logic Flaw

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed...

CVE-2017-10680

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request...

CVE-2017-10678

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request...

CVE-2017-10679

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed...

CVE-2017-10680

CVE-2017-10680 affects Piwigo up to version 2.9.1. The vulnerability is a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack user authentication and change a private album to public via a crafted request. The issue stems from insufficient CSRF protections in Piwigo before or...

CVE-2017-10678

Cross-site request forgery (CSRF) vulnerability in Piwigo up to version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request. Affected software: Piwigo 2.9.1 and earlier. Underlying risk is authenticated users’ actions being forged, w...

CVE-2017-10679

Affected software and issue. Piwigo up to version 2.9.1 is vulnerable to an information-disclosure flaw where a remote attacker can obtain the descriptive name of a permalink by inspecting the redirect URL returned when requesting the permalink ID for a private album. The vulnerability relies on ...

CVE-2017-10681

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request...

CVE-2017-10682

SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the catfalse or cattrue parameter in the comments or status page to catoptions.php...

CVE-2017-10680

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request...

CVE-2017-10681

CVE-2017-10681 is a CSRF vulnerability in Piwigo up to 2.9.1 that could allow hijacking user authentication for album-unlock actions. Connected records reference CVE-2017-10681 as related to broader issues in Piwigo 2.9.3 (e.g., stored XSS via admin endpoints) and state that CSRF exploitation rel...

CVE-2017-10682

CVE-2017-10682 affects Piwigo up to version 2.9.1, with an SQL injection in the administrative backend. The vulnerability allows remote attackers to execute arbitrary SQL commands via the cat_true or cat_false parameter used in the comments/status page to cat_options.php. Affected component: admi...

Piwigo 'ws_session_logout' function security bypass vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A security vulnerability exists in the 'wssessionlogout' function in Piwigo 2.9.1 and earlier versions, which stems from...

Piwigo 'virtual_name' parameter cross-site scripting vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in Piwigo version 2.9.1. A remote attacker can exploit this vulnerability by...

CVE-2017-9836

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

CVE-2017-9836

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

Cross site scripting

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

CVE-2017-9836

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...