1062 matches found
CVE-2016-10084
admin/batchmanager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page'tab' variable aka the mode parameter...
CVE-2016-10083
CVE-2016-10083 affects Piwigo (admin/plugin.php) up to version 2.8.3. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a specific error case. The public records in the connected ...
CVE-2016-10085
Summary: Piwigo
CVE-2016-10084
CVE-2016-10084 affects Piwigo <= 2.8.3 where admin/batch_manager.php allows remote authenticated administrators to perform a file inclusion via the $page['tab'] (mode) parameter. This is a remote inclusion risk with impact on confidentiality/integrity/availability as per CVSS. OpenVAS notes Pi...
Piwigo < 2.8.5 RFI Vulnerability
Piwigo is prone to a remote file inclusion RFI vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...
Piwigo XSS Vulnerability
Piwigo is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...
Piwigo Detection
Detection of Piwigo The script sends a connection request to the server and attempts to detect the presence of Piwigo and to extract its version SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...
Piwigo 'search_rules.php' Cross-Site Scripting Vulnerability
Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the 'search results front end' feature in Piwigo version 2.8.3. A remote...
CVE-2016-9751
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2016-9751
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2016-9751
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2016-9751
Cross-site scripting XSS vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the search parameter...
CVE-2016-9751
CVE-2016-9751 pertains to Piwigo 2.8.3 where the search parameter in the search results front end is susceptible to cross-site scripting (XSS), allowing remote attackers to inject arbitrary script/HTML. The OpenVAS entry confirms a Piwigo XSS vulnerability; other connected sources describe the sa...
Piwigo 2.6.0 /picture.php SQL注入漏洞
/include/functionsrate.inc.php if !isset$rate or !$conf'rate' or !inarray$rate, $conf'rateitems' return false; …….. pwgquery$query; $query = ' INSERT INTO '.RATETABLE.' userid,anonymousid,elementid,rate,date VALUES ' .$user'id'.',' .'''.$anonymousid.'',' .$imageid.',' .$rate .',NOW ;';...
[CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3
CVE-2015-1517 Piwigo - SQL Injection in Version 2.7.3 ---------------------------------------------------------------- Product Information: Software: Piwigo Tested Version: 2.7.3, released on 9 January 2015 Vulnerability Type: SQL Injection CWE-89 Download link: http://piwigo.org/basics/downloads...
Piwigo 'admin.php' SQL Injection Vulnerability
Piwigo is a photo album system based on MySQL5 and PHP5 development. Piwigo 'admin.php' suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...
Piwigo 'admin.php' Cross-Site Scripting Vulnerability
Piwigo is a photo album script written in PHP. A cross-site scripting vulnerability exists in versions of Piwigo prior to 2.7.4, which allows attackers to launch cross-site scripting attacks...
Piwigo 'admin.php' SQL injection vulnerability (CNVD-2015-01256)
Piwigo is a photo album script written in PHP. A SQL injection vulnerability exists in versions prior to Piwigo 2.7.4 due to the program failing to properly filter user-supplied input before using it in SQL queries. This allows an attacker to access or modify data...
CVE-2015-2035
SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...