CVE-2014-1980

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

PT-2014-4402

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to...

CVE-2014-1980: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

Piwigo vulnerable to SQL injection

Overview Piwigo is a software to manage and host image files on the web. Piwigo contains a SQL injection vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

Piwigo vulnerable to cross-site scripting

Overview Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

Piwigo vulnerable to cross-site scripting

Overview Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the "Community" plugin is activated and validation on user uploaded photos is disabled. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...

JVN#80310172: Piwigo vulnerable to cross-site scripting

Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability when the "Community" plugin is activated and validation on user uploaded photos is disabled. Impact When a user views a specially crafted image, arbitrary JavaScript may be execute...

JVN#87962145: Piwigo vulnerable to SQL injection

Piwigo is a software to manage and host image files on the web. Piwigo contains a SQL injection vulnerability. Impact An authenticated attacker may obtain information stored in the database. Solution Apply a patch Apply the patch according to the information provided by the developer. According t...

JVN#09717399: Piwigo vulnerable to cross-site scripting

Piwigo is a software to manage and host image files on the web. Piwigo contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Apply a patch Apply the patch according to the information provided by the developer. According to t...

CVE-2014-4614

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

CVE-2014-4614

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

CVE-2014-4614

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

CVE-2014-4614

Piwigo (pre-2.6.2) is affected by multiple CSRF vulnerabilities that allow remote attackers to hijack administrator authentication via requests to pwg.groups.addUser, pwg.groups.deleteUser, pwg.groups.setInfo, pwg.users.setInfo, pwg.permissions.add, or pwg.permissions.remove. Impact per sources i...

CVE-2014-4614

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

CVE-2014-4614: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the 1 pwg.groups.addUser, 2 pwg.groups.deleteUser, 3 pwg.groups.setInfo, 4 pwg.users.setInfo, 5 pwg.permissions.add, or 6...

PT-2014-6022

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.6.2 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The...

Piwigo 2.5.3 CMS - Multiple Web Vulnerabilities

No description provided by source. Exploit Title: Piwigo 2.5.3 CMS:Multiple vulnerability's Author: sajith version: Piwigo 2.5.3 Vendor Homepage: http://piwigo.org vulnerable app link:http://www.piwigo.org/basics/downloads 1 Stored XSS on Multiple parameters 1 click on Add photos...

Piwigo 2.0.6 - Multiple Vulnerabilities

No description provided by source. Piwigo v2.0.6 Multiple Vulnerabilities Found By: mrme Download: http://piwigo.org/ Tested On: Windows Vista Note: For educational purposes only Vulnerabilities: XSS, CSRF, SQL Injection Author contact date: 13/12/09 Note: There is possibly many other...

piwigo 2.3.3 - Multiple Vulnerabilities

No description provided by source. Advisory ID: HTB23085 Product: Piwigo Vendor: Piwigo project Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Vendor Notification: 4 April 2012 Vendor Patch: 8 April 2012 Public Disclosure: 25 April 2012 Vulnerability Type: Directory Path...