Approved changes feed: RSS · Atom
cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Piwigo (435f9601-9f57-5ff8-bd2f-46b9e78f04e6) |
|---|---|
| Product | Piwigo (d2517e6f-173e-5046-84cf-86cc698c9439) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/piwigo/piwigo |
purl2cpe | 2026-06-01 10:16:53.514551 |
pkg:pypi/piwigo |
purl2cpe | 2026-06-01 10:16:53.514553 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35048 |
vulnerable | 2026-07-29 00:43:24.986222 |
Piwigo RCE via PHP Code Injection into Config File in Installer
CRITICAL (9.8)
The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
Published: 2026-07-20T16:27:09.513Z
Updated: 2026-07-20T17:11:17.973Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27885 |
vulnerable | 2026-06-08 07:55:14.080663 |
Piwigo: SQL Injection in Activity.getList
HIGH (7.2)
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.
Published: 2026-04-03T21:36:07.360Z
Updated: 2026-04-06T13:15:26.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27834 |
vulnerable | 2026-06-08 07:55:14.036173 |
Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter
HIGH (7.2)
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
Published: 2026-04-03T21:35:13.966Z
Updated: 2026-04-06T15:42:28.113Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27833 |
vulnerable | 2026-06-08 07:55:14.035736 |
Piwigo: Unauthenticated Information Disclosure via pwg.history.search API
HIGH (7.5)
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.
Published: 2026-04-03T21:34:11.425Z
Updated: 2026-04-06T18:55:09.077Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27634 |
vulnerable | 2026-06-08 07:53:22.683402 |
Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.
Published: 2026-04-03T21:33:13.838Z
Updated: 2026-04-06T13:13:42.809Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62512 |
vulnerable | 2026-06-08 07:37:29.876726 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62406 |
vulnerable | 2026-06-08 07:37:29.632835 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-48928 |
vulnerable | 2026-06-08 06:50:11.721838 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46606 |
vulnerable | 2026-06-08 06:48:10.194805 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46605 |
vulnerable | 2026-06-08 06:48:10.194190 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46333 |
vulnerable | 2026-06-08 06:48:10.026876 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43018 |
vulnerable | 2026-06-08 06:45:47.222543 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-26450 |
vulnerable | 2026-06-08 06:31:26.394234 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-44393 |
vulnerable | 2026-06-08 06:12:40.901312 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-37270 |
vulnerable | 2026-06-08 06:08:15.048367 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34626 |
vulnerable | 2026-06-08 06:06:25.761428 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-27233 |
vulnerable | 2026-06-08 05:57:40.732546 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26876 |
vulnerable | 2026-06-08 05:57:40.434769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32297 |
vulnerable | 2026-06-08 05:44:43.165050 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45357 |
vulnerable | 2026-06-08 05:36:48.063421 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27973 |
vulnerable | 2026-06-08 05:31:22.812217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-6883 |
vulnerable | 2026-06-08 05:11:54.367983 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-9464 |
vulnerable | 2026-06-08 05:10:09.985306 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-9463 |
vulnerable | 2026-06-08 05:10:09.984980 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-9452 |
vulnerable | 2026-06-08 05:10:09.941784 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-5608 |
vulnerable | 2026-06-08 05:09:47.343907 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-16893 |
vulnerable | 2026-06-08 05:09:07.511557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10682 |
vulnerable | 2026-06-08 05:08:36.215924 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10681 |
vulnerable | 2026-06-08 05:08:36.215581 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10680 |
vulnerable | 2026-06-08 05:08:36.215232 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10679 |
vulnerable | 2026-06-08 05:08:36.214861 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10678 |
vulnerable | 2026-06-08 05:08:36.214403 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-3735 |
vulnerable | 2026-06-08 05:07:45.962958 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10514 |
vulnerable | 2026-06-08 05:07:25.233824 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10513 |
vulnerable | 2026-06-08 05:07:25.233404 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10105 |
vulnerable | 2026-06-08 05:07:17.296864 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10085 |
vulnerable | 2026-06-08 05:07:17.115157 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10084 |
vulnerable | 2026-06-08 05:07:17.114817 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10083 |
vulnerable | 2026-06-08 05:07:17.114394 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2035 |
vulnerable | 2026-06-08 05:06:27.282332 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2034 |
vulnerable | 2026-06-08 05:06:27.281850 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-1517 |
vulnerable | 2026-06-08 05:06:25.779008 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-1441 |
vulnerable | 2026-06-08 05:06:25.669662 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9115 |
vulnerable | 2026-06-08 05:06:10.905839 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4648 |
vulnerable | 2026-06-08 05:05:45.338540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4614 |
vulnerable | 2026-06-08 05:05:45.176119 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3900 |
vulnerable | 2026-06-08 05:05:43.280769 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-1980 |
vulnerable | 2026-06-08 05:05:27.016749 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1469 |
vulnerable | 2026-06-08 05:03:54.138070 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-1468 |
vulnerable | 2026-06-08 05:03:54.105856 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-4526 |
vulnerable | 2026-06-08 05:02:51.158610 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-4525 |
vulnerable | 2026-06-08 05:02:51.157421 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2209 |
vulnerable | 2026-06-08 05:00:53.333657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-2208 |
vulnerable | 2026-06-08 05:00:53.333096 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-1707 |
vulnerable | 2026-06-08 04:54:09.971650 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-4039 |
vulnerable | 2026-06-08 04:51:46.616981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-2933 |
vulnerable | 2026-06-08 04:51:31.387668 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.