Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

121 records

Vendor: Piwigo Clear all filters
TI-2026-30631 CVE-2026-42324

Piwigo: Second-Order SQL Injection

Priority HIGH 67

Piwigo is a full featured open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00916 Published 2026-09-25 Fixed in 16.4.0 CWE-89
TI-2026-30630 CVE-2026-42323

Piwigo: SQL Injection in Batch Manager

Priority HIGH 67

Piwigo is a full featured open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00916 Published 2026-09-25 Fixed in 16.4.0 CWE-89
TI-2026-58834 CVE-2026-85750

Piwigo arbitrary file read and remote code execution via insecure image processing

Priority HIGH 67

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image fil…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01207 Published 2026-09-25 No fix listed CWE-20
TI-2026-27251 CVE-2026-35048

Piwigo RCE via PHP Code Injection into Config File in Installer

Priority HIGH 82

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00579 Published 2026-07-20 No fix listed CWE-20
TI-2026-22229 CVE-2026-27885

Piwigo: SQL Injection in Activity.getList

Priority HIGH 67

Piwigo is an open source photo gallery application for the web.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00378 Published 2026-04-03 Fixed in 16.3.0 CWE-89
TI-2024-32623 CVE-2024-48928

Piwigo's secret key can be brute forced

Priority LOW 13

Piwigo is an open source photo gallery application for the web.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00296 Published 2026-02-24 Fixed in 15.0.0 CWE-330
TI-2024-35274 CVE-2024-52701 · GHSA-48wm-4cr2-qrfh

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo…

Priority MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00269 Published 2024-11-20 No fix listed CWE-79
TI-2024-31060 CVE-2024-46606 · GHSA-rj4v-9qwv-36p2

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of…

Priority MEDIUM 58

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00394 Published 2024-10-16 No fix listed CWE-79
TI-2024-30935 CVE-2024-46333 · GHSA-rr53-gjvx-gr2c

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows…

Priority MEDIUM 55

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album funct…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00301 Published 2024-09-27 No fix listed CWE-79
TI-2023-23899 CVE-2023-44393

Piwigo Reflected XSS vulnerability

Priority HIGH 75

Piwigo is an open source photo gallery application.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.01332 Published 2023-10-09 Fixed in 14.0.0beta4 CWE-79
Load more