CVE-2020-9467

MEDIUM

Piwigo 2.10.1 - Stored Cross-Site Scripting via pwg.images.setInfo File Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-9467. PoCs published by Iridium.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Piwigo 2.10.1 via the `pwg.categories.add` method in a POST request to `/ws.php`. The payload injects a malicious script into the `name` parameter, which is then stored and executed in the context of the application.

Description

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.

Exploits (1)

exploitdb WORKING POC
by Iridium · textwebappsphp
https://www.exploit-db.com/exploits/48814

This exploit demonstrates a stored XSS vulnerability in Piwigo 2.10.1 via the `pwg.categories.add` method in a POST request to `/ws.php`. The payload injects a malicious script into the `name` parameter, which is then stored and executed in the context of the application.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Piwigo 2.10.1
Auth required
Prerequisites: Valid session cookie (`pwg_id`) for authentication
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/Piwigo/Piwigo/issues/1168

Scores

CVSS v3 5.4
EPSS 0.2382
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
piwigo/piwigo 2.10.1
Published Mar 26, 2020
Tracked Since Feb 18, 2026