CVE-2012-2209

Piwigo < 2.3.3 - XSS

Title source: rule
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Piwigo before 2.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter in the configuration module, (2) installstatus parameter in the languages_new module, or (3) theme parameter in the theme module.

Exploits (1)

exploitdb WRITEUP
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/18782

References (9)

Core 9
Core References
Various Sources x_refsource_confirm
http://piwigo.org/forum/viewtopic.php?id=19173
Various Sources x_refsource_confirm
http://piwigo.org/bugs/view.php?id=2607
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/18782
Release Notes x_refsource_confirm
http://piwigo.org/releases/2.3.4
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53245
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75186
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48903
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-04/0196.html

Scores

EPSS 0.0610
EPSS Percentile 90.9%

Details

CWE
CWE-79
Status published
Products (1)
piwigo/piwigo < 2.3.3
Published Aug 14, 2012
Tracked Since Feb 18, 2026