Known vulnerabilities in Piwigo

Vendor: Piwigo.org
Software: Piwigo
Software CPE: cpe:2.3:a:piwigo_org:piwigo:*:*:*:*:*:*:*:*
Total vulnerabilities: 60
Public exploits: 15
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Piwigo Piwigo is affected by 60 known vulnerabilities: 13 high, 18 medium, 29 low Critical High Medium Low

Vulnerabilities (60)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138406 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-62262
CWE-89 High
Available
No
- 20.07.2026 SB2026072017
#VU138399 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-78187
CWE-79 Low
Available
No
- 20.07.2026 SB2026072017
#VU138398 - Improper input validation
CWE-20 Low
Available
No
- 20.07.2026 SB2026072017
#VU138397 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-35048
CWE-94 High
No
No
- 20.07.2026 SB2026072017
#VU138396 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44642
CWE-89 High
Available
No
- 20.07.2026 SB2026072017
#VU138394 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-42324
CWE-89 Low
Available
No
- 20.07.2026 SB2026072017
#VU138392 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-42323
CWE-89 Low
Available
No
- 20.07.2026 SB2026072017
#VU138391 - Unrestricted Upload of File with Dangerous Type
CVE-2026-42322
CWE-434 Low
Available
No
- 20.07.2026 SB2026072017
#VU127945 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27634
CWE-89 Medium
No
No
16.3.0 26.04.2026 SB2026042604
#VU127944 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27885
CWE-89 Low
No
No
16.3.0 26.04.2026 SB2026042604
#VU127943 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27834
CWE-89 Low
No
No
16.3.0 26.04.2026 SB2026042604
#VU127942 - Missing Authorization
CVE-2026-27833
CWE-862 Medium
No
No
- 25.04.2026 SB2026042603
#VU127941 - Insufficient Entropy
CVE-2024-48928
CWE-331 Medium
No
No
14.1.0 25.04.2026 SB2026042602
#VU127940 - Observable Response Discrepancy
CVE-2025-62512
CWE-204 Medium
No
No
15.6.0 25.04.2026 SB2026042601
#VU118614 - Weak password recovery mechanism
CVE-2025-62406
CWE-640 Medium
Available
No
15.7.0 19.11.2025 SB2025111912
#VU127939 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-28662
CWE-79 Low
No
No
14.3.0 01.03.2024 SB2024021243
#VU127938 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
13.8.0 01.03.2024 SB2023070743
#VU127937 - Cross-Site Request Forgery (CSRF)
CVE-2024-26450
CWE-352 Medium
No
No
14.3.0 12.02.2024 SB2024021243
#VU127935 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2023-44393
CWE-80 High
No
No
13.8.0 06.10.2023 SB2023070743
#VU127936 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-37270
CWE-89 Low
No
No
13.8.0 07.07.2023 SB2023070743


Showing elements 1 - 20 out of 60