Known vulnerabilities in Piwigo - page 3

Vendor: Piwigo.org
Software: Piwigo
Software CPE: cpe:2.3:a:piwigo_org:piwigo:*:*:*:*:*:*:*:*
Total vulnerabilities: 60
Public exploits: 15
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Piwigo Piwigo is affected by 60 known vulnerabilities: 13 high, 18 medium, 29 low Critical High Medium Low

Vulnerabilities (60)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU37741 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2017-17822
CWE-89 Medium
No
No
- 21.12.2017 SB2017122014
#VU37742 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2017-17823
CWE-89 Medium
No
No
- 21.12.2017 SB2017122014
#VU37743 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2017-17824
CWE-89 Medium
No
No
- 21.12.2017 SB2017122014
#VU38819 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-9836
CWE-79 Low
No
No
- 24.06.2017 SB2017062403
#VU3123 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2016-10084
CWE-98 Medium
No
No
- 03.01.2017 SB2017010304
#VU3122 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2016-10085
CWE-98 Medium
No
No
- 03.01.2017 SB2017010304
#VU3121 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2016-10105
CWE-98 High
No
No
- 03.01.2017 SB2017010304
#VU3120 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-10083
CWE-79 Low
No
No
- 03.01.2017 SB2017010304
#VU3119 - Improper Control of Generation of Code ('Code Injection')
CVE-2016-10045
CWE-94 High
Available
No
- 03.01.2017 SB2016122801
SB2017010304
SB2017011503
and 11 more
#VU39996 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-9751
CWE-79 Low
No
No
- 01.12.2016 SB2016120109
#VU40908 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2015-1441
CWE-89 Medium
No
No
- 03.02.2015 SB2015020304
#VU40992 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2014-9115
CWE-89 Medium
Available
No
- 23.12.2014 SB2014122302
#VU41400 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-3900
CWE-79 Low
No
No
2.6.3 17.08.2014 SB2014081701
#VU41406 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-1980
CWE-79 Low
No
No
2.4.6 14.08.2014 SB2014081405
#VU41506 - Cross-Site Request Forgery (CSRF)
CVE-2014-4614
CWE-352 Medium
No
No
- 02.07.2014 SB2014070201
#VU41524 - Improper input validation
CVE-2014-4648
CWE-20 High
No
No
- 28.06.2014 SB2014062801
#VU41525 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2014-4649
CWE-89 Medium
No
No
- 28.06.2014 SB2014062802
#VU43005 - Cross-Site Request Forgery (CSRF)
CVE-2013-1468
CWE-352 High
Available
No
- 14.03.2013 SB2013031301
#VU43006 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2013-1469
CWE-22 Medium
Available
No
2.4.7 13.03.2013 SB2013031301
#VU44672 - Exposure of sensitive information to an unauthorized actor
CVE-2011-3790
CWE-200 Medium
No
No
- 24.09.2011 SB2011092413


Showing elements 41 - 60 out of 60