CVE-2019-13364

CRITICAL

Piwigo 2.9.5 - Cross-Site Scripting and Cross-Site Request Forgery via Billing Parameters

Title source: llm

Description

admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.

References (5)

Core 5

Core References

Product x_refsource_misc

https://piwigo.com

Issue Tracking x_refsource_misc

https://github.com/Piwigo/Piwigo/issues

Mailing List, Third Party Advisory x_refsource_misc

http://seclists.org/fulldisclosure/2019/Sep/25

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2020/Jun/29

Scores

CVSS v3 9.6

EPSS 0.0135

EPSS Percentile 68.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

piwigo/piwigo 2.9.5

Published Sep 13, 2019

Tracked Since Feb 18, 2026