Priority HIGH 82
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization.
Piwigo
Records121All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high42CVSS 7.0–8.9
Exploited now
Piwigo records in CISA KEVNo Piwigo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
121 records
TI-2023-16500 CVE-2023-33362 · GHSA-ggjx-vpr3-6vwg
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
Priority HIGH 82
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
TI-2026-44470 CVE-2026-62262
Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
Priority HIGH 80
Piwigo is a full featured open source photo gallery application for the web.
TI-2023-16499 CVE-2023-33361 · GHSA-4h6p-jxpm-6c5p
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
Priority HIGH 76
Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
TI-2023-23899 CVE-2023-44393
Piwigo Reflected XSS vulnerability
Priority HIGH 75
Piwigo is an open source photo gallery application.
Priority HIGH 74
Piwigo is a full featured open source photo gallery application for the web.
TI-2025-38673 CVE-2025-62406
Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
Priority HIGH 73
Piwigo is a full featured open source photo gallery application for the web.
TI-2024-32356 CVE-2024-48311 · GHSA-q4vh-3r4j-jv2p
Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
Priority HIGH 73
Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
TI-2023-11988 CVE-2023-27233 · GHSA-j8qf-5p4m-r7wm
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the…
Priority HIGH 73
Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
TI-2026-22184 CVE-2026-27833
Piwigo: Unauthenticated Information Disclosure via pwg.history.search API
Priority HIGH 72
Piwigo is an open source photo gallery application for the web.
TI-2026-22016 CVE-2026-27634
Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
Priority HIGH 71
Piwigo is an open source photo gallery application for the web.
Priority HIGH 71
Piwigo is open source photo gallery software.
TI-2026-32542 CVE-2026-44642
Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)
Priority HIGH 70
Piwigo is a full featured open source photo gallery application for the web.
TI-2026-58834 CVE-2026-85750
Piwigo arbitrary file read and remote code execution via insecure image processing
Priority HIGH 67
Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image fil…
TI-2026-30631 CVE-2026-42324
Piwigo: Second-Order SQL Injection
Priority HIGH 67
Piwigo is a full featured open source photo gallery application for the web.
TI-2026-30630 CVE-2026-42323
Piwigo: SQL Injection in Batch Manager
Priority HIGH 67
Piwigo is a full featured open source photo gallery application for the web.
TI-2026-22229 CVE-2026-27885
Piwigo: SQL Injection in Activity.getList
Priority HIGH 67
Piwigo is an open source photo gallery application for the web.
TI-2026-22185 CVE-2026-27834
Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter
Priority HIGH 67
Piwigo is an open source photo gallery application for the web.
Priority MEDIUM 64
Piwigo is an open source photo gallery application for the web.
TI-2024-28721 CVE-2024-43018 · GHSA-c4c3-h4wc-4hx3
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and…
Priority MEDIUM 62
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.
TI-2024-31059 CVE-2024-46605 · GHSA-pq4q-5xx3-76hf
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of…
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
TI-2023-28415 CVE-2023-51790 · GHSA-37m4-w5jp-r3px
Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain…
Priority MEDIUM 60
Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.
TI-2024-35274 CVE-2024-52701 · GHSA-48wm-4cr2-qrfh
A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo…
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.
TI-2024-31060 CVE-2024-46606 · GHSA-rj4v-9qwv-36p2
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of…
Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
TI-2022-23777 CVE-2022-48007 · GHSA-xjw6-6j27-9w6v
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0…
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.