Piwigo Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with Piwigo.

Products

Clear product

Showing 17 vulnerabilities on this page for Piwigo

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Piwigo RCE via PHP Code Injection into Config File in Installer

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbh…

CWE-20Jul 20, 2026
CVSS9.8v3.1EPSS0.322%PoCs0SignalsSTIX

Piwigo: SQL Injection in Activity.getList

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

CWE-89Apr 3, 2026
CVSS7.2v3.1EPSS0.364%PoCs0SignalsSTIX

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

CWE-89Apr 3, 2026
CVSS7.2v3.1EPSS0.372%PoCs0SignalsSTIX

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors. This issue has been patched in version 16.3.0.

CWE-862Apr 3, 20261 related artifact
CVSS7.5v3.1EPSS1.64%PoCs0SignalsSTIX

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This could result in an unauthenticated attacker reading the full database, including user password hashes. This issue has been patched in version 16.3.0.

CWE-89Apr 3, 2026
CVSS8.7v4.0EPSS0.651%PoCs0SignalsSTIX

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

CWE-204Feb 24, 20261 related artifact
CVSS5.5v4.0EPSS0.766%PoCs0SignalsSTIX

Piwigo's secret key can be brute forced

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto …

CWE-330Feb 24, 2026
CVSS2.7v4.0EPSS0.26%PoCs0SignalsSTIX

Piwigo is vulnerable to one-click account takeover by modifying the password-reset link

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This iss…

CWE-640Nov 18, 2025
CVSS8.1v3.1EPSS0.393%PoCs0SignalsSTIX

A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter.

CWE-79Nov 20, 2024
CVSS5.4v3.1EPSS0.247%PoCs0SignalsSTIX

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

CWE-352Oct 31, 2024
CVSS8.8v3.1EPSS0.327%PoCs0SignalsSTIX

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CWE-79Oct 16, 2024
CVSS5.4v3.1EPSS0.372%PoCs0SignalsSTIX

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

CWE-79Oct 16, 2024
CVSS6.1v3.1EPSS0.424%PoCs0SignalsSTIX

An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function.

CWE-79Sep 27, 2024
CVSS4.8v3.1EPSS0.284%PoCs0SignalsSTIX

Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the…

CWE-79CWE-80Oct 9, 20231 related artifact
CVSS9.3v3.1EPSS1.28%PoCs0SignalsSTIX

Piwigo SQL Injection vulnerability in "User-Agent"

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL state…

CWE-89Jul 7, 20231 related artifact
CVSS7.6v3.1EPSS4.5%PoCs0SignalsSTIX

piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)

CWE-79Dec 2, 2019
CVSS6.1v3.1EPSS1.21%PoCs0SignalsSTIX

piwigo has XSS in password.php

CWE-79Dec 2, 2019
CVSS6.1v3.1EPSS1.21%PoCs0SignalsSTIX