Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-111292. PoCs published by Arsan.
AI-analyzed exploit summary This is a writeup detailing a stored XSS vulnerability in Piwigo 2.5.2, where malicious JavaScript can be injected into photo metadata fields (Title, Author, Tags, Description) and executed when viewed in the gallery.
Description
Piwigo 2.5.2 - Cross-Site Scripting
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Arsan · textwebappsphp
https://www.exploit-db.com/exploits/28560
This is a writeup detailing a stored XSS vulnerability in Piwigo 2.5.2, where malicious JavaScript can be injected into photo metadata fields (Title, Author, Tags, Description) and executed when viewed in the gallery.
Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
Piwigo 2.5.2
Auth required
Prerequisites:
Authenticated access to Piwigo admin panel · Ability to upload/edit photos
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026