[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3

CVE-2015-1517 Piwigo - SQL Injection in Version 2.7.3 ---------------------------------------------------------------- Product Information: Software: Piwigo Tested Version: 2.7.3, released on 9 January 2015 Vulnerability Type: SQL Injection CWE-89 Download link: http://piwigo.org/basics/downloads...

Piwigo 'admin.php' SQL Injection Vulnerability

Piwigo is a photo album system based on MySQL5 and PHP5 development. Piwigo 'admin.php' suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Piwigo 'admin.php' Cross-Site Scripting Vulnerability

Piwigo is a photo album script written in PHP. A cross-site scripting vulnerability exists in versions of Piwigo prior to 2.7.4, which allows attackers to launch cross-site scripting attacks...

Piwigo 'admin.php' SQL injection vulnerability (CNVD-2015-01256)

Piwigo is a photo album script written in PHP. A SQL injection vulnerability exists in versions prior to Piwigo 2.7.4 due to the program failing to properly filter user-supplied input before using it in SQL queries. This allows an attacker to access or modify data...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

Sql injection

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

Sql injection

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2035

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

CVE-2015-2034

Affected software: Piwigo (PHP photo gallery script). Vulnerability: Cross-site scripting (XSS) in the administrative backend. Component/entry point: admin.php via the page parameter. Versions affected: Piwigo before 2.7.4. Root cause/impact: Allows remote attackers to inject arbitrary web script...

CVE-2015-1517

Piwigo prior to 2.7.4 is affected by an SQL injection in the batch_manager page. When an authenticated user applies all filters and submits Refresh photo set, the parameter filter_level is injectable, enabling boolean-based, error-based and time-based blind SQL injection and potentially arbitrary...

CVE-2015-2034

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-2035

CVE-2015-2035 affects Piwigo (PHP-based photo gallery) with an SQL injection in the administrative backend. The vulnerability exists in admin.php on the history page, where the user parameter is unsafely used in SQL queries, allowing remote attackers with admin access to execute arbitrary SQL com...

Piwigo 2.7.3 - SQL Injection

Piwigo 2.7.3 - SQL Injection CVE-2015-1517 Piwigo - SQL Injection in Version 2.7.3 ---------------------------------------------------------------- Product Information: Software: Piwigo Tested Version: 2.7.3, released on 9 January 2015 Vulnerability Type: SQL Injection CWE-89 Download link:...