Piwigo vulnerabilities

Products

• Piwigo 112
• Lexiglot 9

Newest

• piwigo Piwigo: Authenticated RCE via File Upload in Logo Upload Feature CVE-2026-42322 Public exploit 9.1 CriticalSeptember 25, 2026
• piwigo Piwigo: Second-Order SQL Injection CVE-2026-42324 7.2 HighSeptember 25, 2026
• piwigo Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) CVE-2026-44642 8.1 HighSeptember 25, 2026
• piwigo Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` CVE-2026-62262 9.1 CriticalSeptember 25, 2026
• piwigo Piwigo: SQL Injection in Batch Manager CVE-2026-42323 7.2 HighSeptember 25, 2026
• piwigo Piwigo arbitrary file read and remote code execution via insecure image processing CVE-2026-85750 7.2 HighSeptember 25, 2026
• piwigo Piwigo Image Derivative i.php path traversal CVE-2026-84441 6.9 MediumSeptember 2, 2026
• piwigo Piwigo Public Authentication cross site scripting CVE-2026-78187 2.3 LowAugust 24, 2026
• piwigo Piwigo RCE via PHP Code Injection into Config File in Installer CVE-2026-35048 9.8 CriticalJuly 20, 2026
• piwigo Piwigo: SQL Injection in Activity.getList CVE-2026-27885 7.2 HighApril 3, 2026
• piwigo Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter CVE-2026-27834 7.2 HighApril 3, 2026
• piwigo Piwigo: Unauthenticated Information Disclosure via pwg.history.search API CVE-2026-27833 7.5 HighApril 3, 2026
• piwigo Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter CVE-2026-27634 8.7 HighApril 3, 2026
• piwigo Piwigo Vulnerable to User Enumeration via Password Reset Endpoint CVE-2025-62512 5.5 MediumFebruary 24, 2026
• piwigo Piwigo's secret key can be brute forced CVE-2024-48928 2.7 LowFebruary 24, 2026
• piwigo Piwigo is vulnerable to one-click account takeover by modifying the password-reset link CVE-2025-62406 8.1 HighNovember 18, 2025
• piwigo Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and... CVE-2024-43018 Public exploit 6.4 MediumJuly 29, 2025
• piwigo A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0... CVE-2024-52701 5.4 MediumNovember 20, 2024
• piwigo Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album... CVE-2024-48311 8.8 HighOctober 31, 2024
• piwigo A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5... CVE-2024-46606 5.4 MediumOctober 16, 2024
• piwigo A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5... CVE-2024-46605 6.1 MediumOctober 16, 2024
• piwigo An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to... CVE-2024-46333 4.8 MediumSeptember 27, 2024
• piwigo A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing... CVE-2024-28662 5.4 MediumMarch 13, 2024
• piwigo Cross Site Scripting vulnerability in Piwigo before v.14.2.0 allows a remote attacker to escalate... CVE-2024-26450 5.4 MediumFebruary 28, 2024
• piwigo Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain... CVE-2023-51790 6.1 MediumJanuary 12, 2024
• piwigo Piwigo Reflected XSS vulnerability CVE-2023-44393 9.3 CriticalOctober 9, 2023
• piwigo Piwigo SQL Injection vulnerability in "User-Agent" CVE-2023-37270 7.6 HighJuly 7, 2023
• piwigo Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function. CVE-2023-34626 4.3 MediumJune 15, 2023
• piwigo Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. CVE-2023-33362 Public exploit 9.8 CriticalMay 23, 2023
• piwigo Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. CVE-2023-33361 9.8 CriticalMay 23, 2023
• piwigo Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. CVE-2023-33359 4.3 MediumMay 23, 2023
• piwigo Piwigo v13.5.0 was discovered to contain a SQL injection vulnerability via the order[0][dir]... CVE-2023-27233 8.8 HighMay 17, 2023
• piwigo SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to... CVE-2023-26876 8.8 HighApril 21, 2023
• piwigo A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows... CVE-2022-48007 5.4 MediumJanuary 27, 2023
• piwigo guestbook Piwigo-Guest-Book Navigation Bar guestbook.inc.php sql injection CVE-2014-125053 5.5 MediumJanuary 6, 2023
• piwigo Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. CVE-2022-37183 6.1 MediumAugust 31, 2022
• piwigo Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. CVE-2022-32297 7.5 HighJuly 14, 2022
• piwigo piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. CVE-2021-40553 8.8 HighJune 28, 2022
• piwigo In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function... CVE-2021-40678 5.4 MediumJune 14, 2022
• piwigo Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. CVE-2021-40317 8.8 HighMay 26, 2022
• piwigo SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category... CVE-2020-19217 8.8 HighMay 6, 2022
• piwigo SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter... CVE-2020-19216 8.8 HighMay 6, 2022
• piwigo SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter... CVE-2020-19215 8.8 HighMay 6, 2022
• piwigo SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to... CVE-2020-19213 EPSS 15.9% 9.8 CriticalMay 6, 2022
• piwigo SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to... CVE-2020-19212 4.9 MediumMay 6, 2022
• piwigo Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin... CVE-2022-26267 7.5 HighMarch 18, 2022
• piwigo Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. CVE-2022-26266 8.8 HighMarch 18, 2022
• piwigo Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to... CVE-2022-24620 5.4 MediumFebruary 23, 2022
• piwigo Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in... CVE-2021-45357 6.1 MediumFebruary 10, 2022
• piwigo Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo... CVE-2016-3735 8.1 HighJanuary 28, 2022
• Show olderLoading…