GCVE - cpe:2.3:a:piwigo:piwigo:2.9.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:piwigo:piwigo:2.9.2:*:*:*:*:*:*:*

part: a version: 2.9.2 update: *

Vendor	Piwigo (`435f9601-9f57-5ff8-bd2f-46b9e78f04e6`)
Product	Piwigo (`d2517e6f-173e-5046-84cf-86cc698c9439`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-17827`	vulnerable	2026-06-08 05:09:09.945469	Details available Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. Published: 2017-12-21T04:00:00.000Z Updated: 2024-08-05T20:59:17.924Z Open on db.gcve.eu Reference links https://github.com/Piwigo/Piwigo/issues/822 https://github.com/Piwigo/Piwigo/commit/c3b4c6f7f0ddeaea492080fb8211d7b4cfedaf6f https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20Site%20Request%20Forgery%20in%20Piwigo%202.9.2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17826`	vulnerable	2026-06-08 05:09:09.945181	Details available The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it. Published: 2017-12-21T04:00:00.000Z Updated: 2024-08-05T20:59:18.107Z Open on db.gcve.eu Reference links https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17825`	vulnerable	2026-06-08 05:09:09.944891	Details available The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it. Published: 2017-12-21T04:00:00.000Z Updated: 2024-08-05T20:59:17.956Z Open on db.gcve.eu Reference links https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17824`	vulnerable	2026-06-08 05:09:09.944617	Details available The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database. Published: 2017-12-21T04:00:00.000Z Updated: 2024-08-05T20:59:17.997Z Open on db.gcve.eu Reference links https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84c https://github.com/Piwigo/Piwigo/issues/825	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17823`	vulnerable	2026-06-08 05:09:09.944305	Details available The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database. Published: 2017-12-21T04:00:00.000Z Updated: 2024-08-05T20:59:17.921Z Open on db.gcve.eu Reference links https://github.com/Piwigo/Piwigo/issues/826 https://github.com/Piwigo/Piwigo/commit/91ef7909a5c51203f330cbecf986472900b60983 https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17822`	vulnerable	2026-06-08 05:09:09.943975	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17775`	vulnerable	2026-06-08 05:09:09.895004	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-17774`	vulnerable	2026-06-08 05:09:09.894624	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.