CVE-2026-35048 | Critical | 9.8 | 2026-07-20 | The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file w… |
CVE-2026-27885 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the A… |
CVE-2026-27834 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Serv… |
CVE-2026-27833 | High | 7.5 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the… |
CVE-2026-27634 | Critical | 9.8 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_avai… |
CVE-2025-62512 | Medium | 5.3 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo… |
CVE-2024-48928 | High | 7.5 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set… |
CVE-2025-62406 | High | 8.1 | 2025-11-18 | Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-rese… |
CVE-2024-43018 | Medium | 6.4 | 2025-07-29 | Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from… |
CVE-2024-52701 | Medium | 5.4 | 2024-11-20 | A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2024-48311 | High | 8.8 | 2024-10-31 | Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. |
CVE-2024-46606 | Medium | 5.4 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-46605 | Medium | 6.1 | 2024-10-16 | A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2024-46333 | Medium | 4.8 | 2024-09-27 | An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inj… |
CVE-2024-28662 | Medium | 5.4 | 2024-03-13 | A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php. |
CVE-2024-26450 | Medium | 5.4 | 2024-02-28 | An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forge… |
CVE-2023-51790 | Medium | 6.1 | 2024-01-12 | Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-i… |
CVE-2023-44393 | Critical | 9.3 | 2023-10-09 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?pa… |
CVE-2023-37270 | High | 7.6 | 2023-07-07 | Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL… |
CVE-2023-34626 | Medium | 4.3 | 2023-06-15 | Piwigo 13.7.0 is vulnerable to SQL Injection via the "Users" function. |
CVE-2023-33362 | Critical | 9.8 | 2023-05-23 | Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. |
CVE-2023-33361 | Critical | 9.8 | 2023-05-23 | Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. |
CVE-2023-33359 | Medium | 4.3 | 2023-05-23 | Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. |
CVE-2023-27233 | High | 8.8 | 2023-05-17 | Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php. |
CVE-2023-26876 | High | 8.8 | 2023-04-21 | SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id parameter to the admi… |
CVE-2022-48007 | Medium | 5.4 | 2023-01-27 | A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2014-125053 | Medium | 5.5 | 2023-01-06 | A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guest… |
CVE-2022-37183 | Medium | 6.1 | 2022-08-31 | Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. |
CVE-2022-32297 | High | 7.5 | 2022-07-14 | Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. |
CVE-2021-40553 | High | 8.8 | 2022-06-28 | piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. |
CVE-2021-40678 | Medium | 5.4 | 2022-06-14 | In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit. |
CVE-2021-40317 | High | 8.8 | 2022-05-26 | Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. |
CVE-2020-19217 | High | 8.8 | 2022-05-06 | SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. |
CVE-2020-19216 | High | 8.8 | 2022-05-06 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. |
CVE-2020-19215 | High | 8.8 | 2022-05-06 | SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. |
CVE-2020-19213 | Critical | 9.8 | 2022-05-06 | SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. |
CVE-2020-19212 | Medium | 4.9 | 2022-05-06 | SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. |
CVE-2022-26267 | High | 7.5 | 2022-03-18 | Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. |
CVE-2022-26266 | High | 8.8 | 2022-03-18 | Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. |
CVE-2022-24620 | Medium | 5.4 | 2022-02-24 | Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cook… |
CVE-2021-45357 | Medium | 6.1 | 2022-02-10 | Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php. |
CVE-2016-3735 | High | 8.1 | 2022-01-28 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke… |
CVE-2021-40882 | Medium | 6.1 | 2021-12-14 | A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location. |
CVE-2021-40313 | High | 8.8 | 2021-12-06 | Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php. |
CVE-2020-22150 | Medium | 6.1 | 2021-07-21 | A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-22148 | Medium | 6.1 | 2021-07-21 | A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2021-32615 | Critical | 9.8 | 2021-05-13 | Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. |
CVE-2021-31783 | High | 7.5 | 2021-04-26 | show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a pr… |
CVE-2021-27973 | High | 7.2 | 2021-04-02 | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. |
CVE-2014-8945 | Critical | 9.8 | 2020-06-01 | admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. |
CVE-2014-8944 | Medium | 5.4 | 2020-06-01 | Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_con… |
CVE-2014-8943 | High | 8.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. |
CVE-2014-8942 | High | 8.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows CSRF. |
CVE-2014-8941 | Critical | 9.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. |
CVE-2014-8940 | Medium | 5.3 | 2020-06-01 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. |
CVE-2014-8939 | Medium | 5.3 | 2020-06-01 | Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request… |
CVE-2014-8938 | High | 7.8 | 2020-06-01 | Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. |
CVE-2014-8937 | High | 7.5 | 2020-06-01 | Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. |
CVE-2020-9468 | Medium | 4.3 | 2020-03-26 | The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the… |
CVE-2020-9467 | Medium | 5.4 | 2020-03-26 | Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function. |
CVE-2020-8089 | Medium | 5.4 | 2020-02-10 | Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page. |
CVE-2012-4526 | Medium | 6.1 | 2019-12-02 | piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) |
CVE-2012-4525 | Medium | 6.1 | 2019-12-02 | piwigo has XSS in password.php |
CVE-2019-13364 | Critical | 9.6 | 2019-09-13 | admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable… |
CVE-2019-13363 | Critical | 9.6 | 2019-09-13 | admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_… |
CVE-2014-4613 | Medium | 6.5 | 2018-03-16 | Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of admi… |
CVE-2018-7724 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CV… |
CVE-2018-7723 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836… |
CVE-2018-7722 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may… |
CVE-2018-6883 | Medium | 4.9 | 2018-02-24 | Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attack… |
CVE-2018-5692 | Medium | 6.1 | 2018-01-14 | Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, and `display` parameters of the `admin.php` file. |
CVE-2017-17827 | High | 8.8 | 2017-12-21 | Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker… |
CVE-2017-17826 | Medium | 6.1 | 2017-12-21 | The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration… |
CVE-2017-17825 | Medium | 4.8 | 2017-12-21 | The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mod… |
CVE-2017-17824 | Medium | 4.9 | 2017-12-21 | The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker… |
CVE-2017-17823 | Medium | 4.9 | 2017-12-21 | The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit th… |
CVE-2017-17822 | Medium | 4.9 | 2017-12-21 | The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to ga… |
CVE-2017-17775 | Medium | 6.1 | 2017-12-20 | Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. |
CVE-2017-17774 | High | 8.8 | 2017-12-20 | admin/configuration.php in Piwigo 2.9.2 has CSRF. |
CVE-2017-16893 | Medium | 6.5 | 2017-12-01 | The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attack… |
CVE-2016-10514 | Medium | 6.5 | 2017-10-10 | url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a "… |
CVE-2016-10513 | Medium | 6.1 | 2017-10-10 | Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php. |
CVE-2017-10682 | Critical | 9.8 | 2017-06-29 | SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or ca… |
CVE-2017-10681 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock al… |
CVE-2017-10680 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a… |
CVE-2017-10679 | High | 7.5 | 2017-06-29 | Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is re… |
CVE-2017-10678 | High | 8.8 | 2017-06-29 | Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete pe… |
CVE-2017-9836 | Medium | 4.8 | 2017-06-24 | Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name… |
CVE-2017-9464 | Medium | 6.1 | 2017-06-14 | An open redirect vulnerability is present in Piwigo 2.9 and probably prior versions, allowing remote attackers to redirect users to arbitrary web sites and con… |
CVE-2017-9463 | Medium | 6.5 | 2017-06-14 | The application Piwigo is affected by a SQL injection vulnerability in version 2.9.0 and possibly prior. This vulnerability allows remote authenticated attacke… |
CVE-2017-9452 | Medium | 4.8 | 2017-06-06 | Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page p… |
CVE-2017-5608 | Medium | 6.1 | 2017-01-28 | Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2016-10105 | Critical | 9.8 | 2017-01-03 | admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code… |
CVE-2016-10085 | High | 7.2 | 2016-12-30 | admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter. |
CVE-2016-10084 | High | 7.2 | 2016-12-30 | admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka… |
CVE-2016-10083 | Medium | 6.1 | 2016-12-30 | Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a craft… |
CVE-2016-9751 | Medium | 6.1 | 2016-12-01 | Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2015-2035 | | | 2015-02-20 | SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user pa… |
CVE-2015-2034 | | | 2015-02-20 | Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2015-1517 | | | 2015-02-20 | SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the… |