Description
SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the items_number parameter.
References (3)
Core 3
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/36333
URL Repurposed x_refsource_misc
http://www.senseofsecurity.com.au/advisories/SOS-09-007.pdf
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/505801/100/0/threaded
Scores
EPSS
0.0109
EPSS Percentile
61.8%
Details
CWE
CWE-89
Status
published
Products (1)
piwigo/piwigo
< 2.0
Published
Aug 21, 2009
Tracked Since
Feb 18, 2026