GCVE - cpe:2.3:a:piwigo:piwigo:2.1.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:piwigo:piwigo:2.1.5:*:*:*:*:*:*:*

part: a version: 2.1.5 update: *

Vendor	Piwigo (`435f9601-9f57-5ff8-bd2f-46b9e78f04e6`)
Product	Piwigo (`d2517e6f-173e-5046-84cf-86cc698c9439`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/piwigo/piwigo`	purl2cpe	2026-06-01 10:16:53.515018
`pkg:pypi/piwigo`	purl2cpe	2026-06-01 10:16:53.515020

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-4614`	vulnerable	2026-06-08 05:05:45.197619	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method. Published: 2014-07-02T20:00:00.000Z Updated: 2024-08-06T11:20:26.672Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q2/623 http://piwigo.org/bugs/view.php?id=0003055 http://piwigo.org/releases/2.6.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1980`	vulnerable	2026-06-08 05:05:27.026268	Details available Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin. Published: 2014-08-14T01:00:00.000Z Updated: 2024-08-06T09:58:15.564Z Open on db.gcve.eu Reference links http://jvn.jp/en/jp/JVN80310172/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000092 http://piwigo.org/bugs/view.php?id=2805	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1469`	vulnerable	2026-06-08 05:03:54.138763	Details available Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter. Published: 2013-03-13T20:48:00.000Z Updated: 2024-09-17T02:42:20.049Z Open on db.gcve.eu Reference links http://piwigo.org/forum/viewtopic.php?id=21470 http://piwigo.org/releases/2.4.7 https://www.htbridge.com/advisory/HTB23144 http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html http://www.exploit-db.com/exploits/24561	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1468`	vulnerable	2026-06-08 05:03:54.127237	Details available Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors. Published: 2013-03-12T16:00:00.000Z Updated: 2024-09-16T16:38:45.778Z Open on db.gcve.eu Reference links http://piwigo.org/forum/viewtopic.php?id=21470 http://piwigo.org/releases/2.4.7 https://www.htbridge.com/advisory/HTB23144 http://secunia.com/advisories/52228 http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3790`	vulnerable	2026-06-08 04:59:27.849597	Details available Piwigo 2.1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/metadata.php and certain other files. Published: 2011-09-24T00:00:00.000Z Updated: 2024-09-16T21:57:19.991Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/06/27/6 http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwigo-2.1.5	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.