CVE-2019-13363

CRITICAL

Piwigo 2.9.5 - Cross-Site Scripting and Cross-Site Request Forgery via Notification by Mail Parameters

Title source: llm

Description

admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.

References (5)

Core 5

Core References

Issue Tracking, Product x_refsource_misc

https://github.com/Piwigo/Piwigo/issues

Mailing List, Third Party Advisory x_refsource_misc

http://seclists.org/fulldisclosure/2019/Sep/25

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2020/Jun/29

Product x_refsource_misc

https://piwigo.com

Scores

CVSS v3 9.6

EPSS 0.0135

EPSS Percentile 68.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

piwigo/piwigo 2.9.5

Published Sep 13, 2019

Tracked Since Feb 18, 2026