GCVE - cpe:2.3:a:piwigo:piwigo:2.6.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:piwigo:piwigo:2.6.0:*:*:*:*:*:*:*

part: a version: 2.6.0 update: *

Vendor	Piwigo (`435f9601-9f57-5ff8-bd2f-46b9e78f04e6`)
Product	Piwigo (`d2517e6f-173e-5046-84cf-86cc698c9439`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/piwigo/piwigo`	purl2cpe	2026-06-01 10:16:53.515245
`pkg:pypi/piwigo`	purl2cpe	2026-06-01 10:16:53.515246

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-1441`	vulnerable	2026-06-08 05:06:25.670267	Details available SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2015-02-03T16:00:00.000Z Updated: 2024-08-06T04:40:18.705Z Open on db.gcve.eu Reference links http://piwigo.org/releases/2.6.5 http://secunia.com/advisories/62606 http://piwigo.org/releases/2.7.3 http://piwigo.org/forum/viewtopic.php?id=25016 http://www.securityfocus.com/bid/72400	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9115`	vulnerable	2026-06-08 05:06:10.906443	Details available SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit. Published: 2014-12-23T11:00:00.000Z Updated: 2024-08-06T13:33:13.578Z Open on db.gcve.eu Reference links http://piwigo.org/forum/viewtopic.php?id=24850 http://piwigo.org/releases/2.7.2 http://seclists.org/fulldisclosure/2014/Nov/23 http://piwigo.org/dev/changeset/30563/trunk/include/functions_rate.inc.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4649`	vulnerable	2026-06-08 05:05:45.338903	Details available SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field. Published: 2014-06-28T15:00:00.000Z Updated: 2024-08-06T11:20:26.648Z Open on db.gcve.eu Reference links http://piwigo.org/bugs/view.php?id=3089 http://piwigo.org/bugs/changelog_page.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4648`	vulnerable	2026-06-08 05:05:45.338564	Details available Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure." Published: 2014-06-28T15:00:00.000Z Updated: 2024-08-06T11:20:26.675Z Open on db.gcve.eu Reference links http://piwigo.org/releases/2.6.3 http://piwigo.org/forum/viewtopic.php?id=24009	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4614`	vulnerable	2026-06-08 05:05:45.208616	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method. Published: 2014-07-02T20:00:00.000Z Updated: 2024-08-06T11:20:26.672Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q2/623 http://piwigo.org/bugs/view.php?id=0003055 http://piwigo.org/releases/2.6.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3900`	vulnerable	2026-06-08 05:05:43.281433	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.