Vulnerabilities

TI-2026-22229 CVE-2026-27885

Piwigo: SQL Injection in Activity.getList

HIGH 67

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00378 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2026-22185 CVE-2026-27834

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter

HIGH 67

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00378 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2026-22184 CVE-2026-27833

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

HIGH 72

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01641 Published 2026-04-03 Fixed in 16.3.0 CWE-862

TI-2026-22016 CVE-2026-27634

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter

HIGH 71

Piwigo is an open source photo gallery application for the web.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00663 Published 2026-04-03 Fixed in 16.3.0 CWE-89

TI-2025-38753 CVE-2025-62512

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

MEDIUM 64

Piwigo is an open source photo gallery application for the web.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00831 Published 2026-02-24 No fix listed CWE-204

TI-2024-32623 CVE-2024-48928

Piwigo's secret key can be brute forced

LOW 13

Piwigo is an open source photo gallery application for the web.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00296 Published 2026-02-24 Fixed in 15.0.0 CWE-330

TI-2025-38673 CVE-2025-62406

Piwigo is vulnerable to one-click account takeover by modifying the password-reset link

HIGH 73

Piwigo is a full featured open source photo gallery application for the web.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00431 Published 2025-11-18 No fix listed CWE-640

TI-2024-28721 CVE-2024-43018 · GHSA-c4c3-h4wc-4hx3

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and…

MEDIUM 62

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00336 Published 2025-07-29 No fix listed CWE-89

TI-2024-35274 CVE-2024-52701 · GHSA-48wm-4cr2-qrfh

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00269 Published 2024-11-20 No fix listed CWE-79

TI-2024-32356 CVE-2024-48311 · GHSA-q4vh-3r4j-jv2p

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

HIGH 73

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00347 Published 2024-10-31 No fix listed CWE-352

TI-2024-31060 CVE-2024-46606 · GHSA-rj4v-9qwv-36p2

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00394 Published 2024-10-16 No fix listed CWE-79

TI-2024-31059 CVE-2024-46605 · GHSA-pq4q-5xx3-76hf

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00449 Published 2024-10-16 No fix listed CWE-79

TI-2024-30935 CVE-2024-46333 · GHSA-rr53-gjvx-gr2c

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows…

MEDIUM 55

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album funct…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00301 Published 2024-09-27 No fix listed CWE-79

TI-2024-18934 CVE-2024-28662 · GHSA-9q37-6mpp-rv7v

A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of…

LOW 25

A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00434 Published 2024-03-13 No fix listed CWE-79

TI-2024-17417 CVE-2024-26450 · GHSA-wqm3-jgh5-wqrh

An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the…

LOW 24

An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00187 Published 2024-02-28 No fix listed CWE-352

TI-2023-28415 CVE-2023-51790 · GHSA-37m4-w5jp-r3px

Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain…

MEDIUM 60

Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00505 Published 2024-01-12 No fix listed CWE-79

TI-2023-23899 CVE-2023-44393

Piwigo Reflected XSS vulnerability

HIGH 75

Piwigo is an open source photo gallery application.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.01332 Published 2023-10-09 Fixed in 14.0.0beta4 CWE-79

TI-2023-18900 CVE-2023-37270

Piwigo SQL Injection vulnerability in "User-Agent"

HIGH 71

Piwigo is open source photo gallery software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.045 Published 2023-07-07 Fixed in 13.8.0 CWE-89

TI-2023-17350 CVE-2023-34626 · GHSA-g8rr-g77c-8v8c

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.

MEDIUM 53

Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00546 Published 2023-06-15 No fix listed CWE-89

TI-2023-16500 CVE-2023-33362 · GHSA-ggjx-vpr3-6vwg

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

HIGH 82

Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09058 Published 2023-05-23 No fix listed CWE-89

TI-2023-16499 CVE-2023-33361 · GHSA-4h6p-jxpm-6c5p

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

HIGH 76

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00915 Published 2023-05-23 No fix listed CWE-89

TI-2023-16498 CVE-2023-33359 · GHSA-wgm9-f6hq-j59g

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

MEDIUM 53

Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00391 Published 2023-05-23 No fix listed CWE-352

TI-2023-11988 CVE-2023-27233 · GHSA-j8qf-5p4m-r7wm

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the…

HIGH 73

Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00902 Published 2023-05-17 No fix listed CWE-89

TI-2023-11813 CVE-2023-26876 · GHSA-4xvf-3477-vq63

SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker…

MEDIUM 52

SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admin.php?page=history&filter_image_id=&filter_user_id endpoint.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09725 Published 2023-04-21 No fix listed CWE-89

TI-2022-23777 CVE-2022-48007 · GHSA-xjw6-6j27-9w6v

A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2023-01-27 No fix listed CWE-79

Vulnerabilities

Filters