Piwigo

Records121All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high42CVSS 7.0–8.9

Exploited now

Piwigo records in CISA KEV

No Piwigo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Piwigo 103 records HIGH Lexiglot 9 records MEDIUM Guestbook 1 record MEDIUM Localfiles Editor 1 record LOW

Records

103 records in Piwigo · all components

TI-2023-16500 CVE-2023-33362 · GHSA-ggjx-vpr3-6vwg

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

HIGH 82

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09058 Published 2023-05-23 No fix listed CWE-89

TI-2023-16499 CVE-2023-33361 · GHSA-4h6p-jxpm-6c5p

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

HIGH 76

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00915 Published 2023-05-23 No fix listed CWE-89

TI-2023-23899 CVE-2023-44393

Piwigo Reflected XSS vulnerability

HIGH 75

Piwigo is an open source photo gallery application.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.01332 Published 2023-10-09 Fixed in 14.0.0beta4 CWE-79

TI-2025-38673 CVE-2025-62406

Piwigo is vulnerable to one-click account takeover by modifying the password-reset link

HIGH 73

Piwigo is a full featured open source photo gallery application for the web.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00431 Published 2025-11-18 No fix listed CWE-640

TI-2024-32356 CVE-2024-48311 · GHSA-q4vh-3r4j-jv2p

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

HIGH 73

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00347 Published 2024-10-31 No fix listed CWE-352

TI-2023-11988 CVE-2023-27233 · GHSA-j8qf-5p4m-r7wm

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the…

HIGH 73

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00902 Published 2023-05-17 No fix listed CWE-89

TI-2026-22184 CVE-2026-27833

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

HIGH 72

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01641 Published 2026-04-03 Fixed in 16.3.0 CWE-862

TI-2026-22016 CVE-2026-27634

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter

HIGH 71

Piwigo is an open source photo gallery application for the web.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00663 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2023-18900 CVE-2023-37270

Piwigo SQL Injection vulnerability in "User-Agent"

HIGH 71

Piwigo is open source photo gallery software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.045 Published 2023-07-07 Fixed in 13.8.0 CWE-89

TI-2026-22229 CVE-2026-27885

Piwigo: SQL Injection in Activity.getList

HIGH 67

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00378 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2026-22185 CVE-2026-27834

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter

HIGH 67

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00378 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2025-38753 CVE-2025-62512

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

MEDIUM 64

Piwigo is an open source photo gallery application for the web.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00831 Published 2026-02-24 No fix listed CWE-204

TI-2024-28721 CVE-2024-43018 · GHSA-c4c3-h4wc-4hx3

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and…

MEDIUM 62

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00336 Published 2025-07-29 No fix listed CWE-89

TI-2024-31059 CVE-2024-46605 · GHSA-pq4q-5xx3-76hf

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00449 Published 2024-10-16 No fix listed CWE-79

TI-2023-28415 CVE-2023-51790 · GHSA-37m4-w5jp-r3px

Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain…

MEDIUM 60

Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00505 Published 2024-01-12 No fix listed CWE-79

TI-2024-35274 CVE-2024-52701 · GHSA-48wm-4cr2-qrfh

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00269 Published 2024-11-20 No fix listed CWE-79

TI-2024-31060 CVE-2024-46606 · GHSA-rj4v-9qwv-36p2

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00394 Published 2024-10-16 No fix listed CWE-79

TI-2022-23777 CVE-2022-48007 · GHSA-xjw6-6j27-9w6v

A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2023-01-27 No fix listed CWE-79

TI-2020-13561 CVE-2020-19213 · GHSA-vh34-3hh2-2r2j

SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.

MEDIUM 58

SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15878 Published 2022-05-06 No fix listed CWE-89

TI-2024-30935 CVE-2024-46333 · GHSA-rr53-gjvx-gr2c

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows…

MEDIUM 55

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album funct…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00301 Published 2024-09-27 No fix listed CWE-79

TI-2023-17350 CVE-2023-34626 · GHSA-g8rr-g77c-8v8c

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.

MEDIUM 53

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00546 Published 2023-06-15 No fix listed CWE-89

TI-2023-16498 CVE-2023-33359 · GHSA-wgm9-f6hq-j59g

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

MEDIUM 53

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00391 Published 2023-05-23 No fix listed CWE-352

TI-2017-07810 CVE-2017-10682 · GHSA-j8f8-65f8-c2p3

SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows…

MEDIUM 53

SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_option…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08306 Published 2017-06-29 No fix listed CWE-89

TI-2023-11813 CVE-2023-26876 · GHSA-4xvf-3477-vq63

SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker…

MEDIUM 52

SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09725 Published 2023-04-21 No fix listed CWE-89

TI-2013-01276 CVE-2013-1469 · GHSA-p4fq-jh4w-p6hr

Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote…

MEDIUM 52

Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a ..

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.56011 Published 2013-03-13 No fix listed CWE-22

Open these records in search →