{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D356328-15B0-4402-94E6-8C16E09EB088",
                     versionEndIncluding: "2.9.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad Cross-Site Request Forgery (CSRF) en Piwigo hasta la versión 2.9.1 permite que atacantes remotos secuestren la autenticación de usuarios para peticiones para cambiar un álbum privado a público mediante una petición manipulada.",
      },
   ],
   id: "CVE-2017-10680",
   lastModified: "2024-11-21T03:06:17.087",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-06-29T21:29:00.267",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/99349",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Technical Description",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/721",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/99349",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Technical Description",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/721",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78E1C4D0-B42E-4FF9-9DB3-313B2A4A8251",
                     versionEndIncluding: "2.8.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.",
      },
      {
         lang: "es",
         value: "admin/plugin.php en Piwigo hasta la versión 2.8.3 no valida el variable de secciones al usarlo para incluir archivos. Esto puede provocar la divulgación de información y la ejecución de código si contiene una secuencia .. .",
      },
   ],
   id: "CVE-2016-10105",
   lastModified: "2024-11-21T02:43:19.020",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-03T06:59:00.137",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/95202",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/8796e43aa344681d92a92e1f9b985409d4f36e31",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/9004fdfc0b4a11cb32e9e15a5f67e4ec827e82dc",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/574#issuecomment-267938358",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/95202",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/8796e43aa344681d92a92e1f9b985409d4f36e31",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/9004fdfc0b4a11cb32e9e15a5f67e4ec827e82dc",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/574#issuecomment-267938358",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.9.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "BB83CB5C-D31C-42B7-B011-72AE25409448",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database.",
      },
      {
         lang: "es",
         value: "La API List Users de Piwigo 2.9.2 es vulnerable a inyección SQL mediante el parámetro sSortDir_0 en /admin/user_list_backend.php. Un atacante puede explotarlo para obtener acceso a la información en una base de datos MySQL conectada.",
      },
   ],
   id: "CVE-2017-17822",
   lastModified: "2024-11-21T03:18:45.133",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-12-21T04:29:00.260",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/33a03e9afb8fb00c9d8f480424d549311fe03d40",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/823",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/33a03e9afb8fb00c9d8f480424d549311fe03d40",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/823",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.10.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "8E8B6457-1AF4-4B29-AF6E-9682E45BB2A9",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de tipo cross site scripting (XSS) almacenado en el archivo /admin.php?page=tags de Piwigo versión 2.10.1, permite a atacantes ejecutar scripts web o HTML arbitrarios",
      },
   ],
   id: "CVE-2020-22148",
   lastModified: "2024-11-21T05:13:06.920",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-07-21T17:15:08.123",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1157",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1157",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:11.5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B6BC6DF8-D938-4413-B4C7-132BCC938E68",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch_manager&mode=unit.",
      },
      {
         lang: "es",
         value: "En Piwigo versión 11.5.0, se presenta una vulnerabilidad de tipo cross-site scripting persistente en la función de modo único mediante /admin.php?page=batch_manager&mode=unit",
      },
   ],
   id: "CVE-2021-40678",
   lastModified: "2024-11-21T06:24:33.500",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 3.5,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:S/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-06-14T13:15:07.937",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1476",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1476",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BDC77171-712D-461F-83B8-953EB077F285",
                     versionEndIncluding: "12.1.0",
                     versionStartIncluding: "12.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.",
      },
      {
         lang: "es",
         value: "Se presenta una vulnerabilidad de tipo Cross Site Scripting (XSS) en Piwigo versión 12.x, por medio de la función pwg_activity en el archivo include/functions.inc.php",
      },
   ],
   id: "CVE-2021-45357",
   lastModified: "2024-11-21T06:32:08.013",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-02-10T18:15:08.383",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1582",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1582",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6B6B020F-0D8F-4DCB-A443-6A1398E0B3DA",
                     versionEndIncluding: "2.8.5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad XSS en la función de carga de imágenes en Piwigo en versiones anteriores a 2.8.6 permite a un atacantes inyectar secuencias de comandos web o HTML arbitrarios a través de un nombre de archivo de imagen manipulado.",
      },
   ],
   id: "CVE-2017-5608",
   lastModified: "2024-11-21T03:27:59.880",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-28T18:59:00.133",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.8.6",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/95848",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/600",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.8.6",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/95848",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/commit/6ec3f2d0fae0437f0c2cc8c475a26fb6aeb0d4cb",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/600",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:12.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "81C2A86F-D640-455A-915C-B187ECB741AC",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.",
      },
      {
         lang: "es",
         value: "Se ha detectado que Piwigo versión v12.2.0, contiene un filtrado de información por medio del parámetro action en el archivo /admin/maintenance_actions.php",
      },
   ],
   id: "CVE-2022-26267",
   lastModified: "2024-11-21T06:53:40.217",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-03-18T23:15:07.870",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_InforMation_Disclosure.md",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_InforMation_Disclosure.md",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-306",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:13.6.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "C0F29243-1953-4593-9D93-65BAF0D5D0EB",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.",
      },
   ],
   id: "CVE-2023-33361",
   lastModified: "2025-01-31T16:15:30.407",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2023-05-23T14:15:09.863",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1910",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1910",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B4B9AEE3-C9C5-4D20-BA38-9E5A2A64FABD",
                     versionEndIncluding: "13.7.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Piwigo 13.7.0 is vulnerable to SQL Injection via the \"Users\" function.",
      },
   ],
   id: "CVE-2023-34626",
   lastModified: "2024-11-21T08:07:27.927",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-06-15T16:15:09.347",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1924",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1924",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:12.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "81C2A86F-D640-455A-915C-B187ECB741AC",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.",
      },
      {
         lang: "es",
         value: "Se ha detectado que Piwigo versión v12.2.0, contiene una vulnerabilidad de inyección SQL por medio del archivo pwg.users.php",
      },
   ],
   id: "CVE-2022-26266",
   lastModified: "2024-11-21T06:53:40.080",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-03-18T23:15:07.833",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_SQLinject.md",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/JCCD/Vul/blob/main/Piwigo_12.2.0_SQLinject.md",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "61D5A594-379F-42FF-BC3E-01793AE929FE",
                     versionEndIncluding: "2.5.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "BE8F6745-8E09-4D58-B097-E1C62305B46B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.6.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "6CBD76E1-0362-4CFE-A306-CE5F13ADA54B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.6.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "B95C9758-4EE5-4690-8EDF-575907C3A15A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.6.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "8AE2DA12-FDBC-47DF-AC4A-61581D5941ED",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.6.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6EDF6D0E-33DD-483C-996F-D6159A744BA8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.0:beta1:*:*:*:*:*:*",
                     matchCriteriaId: "533214A7-83F9-49E1-BF53-DA53E5AE2F82",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.0:beta2:*:*:*:*:*:*",
                     matchCriteriaId: "92705F58-8812-43D0-A35E-5695A60BBD0A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.0:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "BBB74696-421F-4414-BB75-996107E2A12B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.0:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "41B4D40F-2571-4729-BBF6-1014C7A3DC0C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5C68DAF3-6C49-438A-881B-A261B267C55A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.7.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "5E0A6114-5FC1-41C2-8F89-9EE6B76E5E0F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de SQL en Piwigo anterior a 2.5.6, 2.6.x anterior a 2.6.5, y 2.7.x anterior a 2.7.3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2015-1441",
   lastModified: "2024-11-21T02:25:25.993",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-02-03T16:59:26.563",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/forum/viewtopic.php?id=25016",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.5.6",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.6.5",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.7.3",
      },
      {
         source: "cve@mitre.org",
         url: "http://secunia.com/advisories/62606",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/72400",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/forum/viewtopic.php?id=25016",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.5.6",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.6.5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "http://piwigo.org/releases/2.7.3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/62606",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/72400",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C317128C-7749-4BE1-A7D3-88CAB5BE6F67",
                     versionEndIncluding: "2.4.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.0.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "D245F2A4-676D-478F-8D0F-E183CF52E656",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA08469C-BD2B-4EDA-86DB-35F65A1A35E4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "2E349A00-60C3-426A-B6AA-B940B60B28F4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9D724AA1-B057-409F-ABCA-064586771118",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D3A4E8E3-1920-43CB-9D84-9EF84BB5F9CF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "38A03451-C199-44DD-A4ED-298B50193FA6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "AB4DCFBE-C8FC-4D80-9DE6-04BBC3494949",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "752561BC-D824-4264-8697-DD9DE88F7D53",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.3.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "615E6F3A-162D-42F6-A537-442E9ED0B385",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.3.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "36F26A2A-2175-4665-ACA5-A417A665B662",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "A2D17AE0-823E-41EC-A282-10103975E792",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E99613B2-BF99-4A44-9240-9720A17206A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "ADBE8CF0-1CBE-478D-9E1E-54363F3B7C09",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B899A695-73BA-4459-86E4-E96E12FB4CA2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.5.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "7081BEAD-39F5-48EC-B13F-81073D7C4C2C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.5.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "EAC7628A-2083-41A2-8621-DACD3F769C53",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D565B05-80D5-400A-ADBB-8DE393798D7E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.6.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F7623DB-E676-41B3-A15D-6769BF7E230D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.6.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "FDC7011F-D136-4402-93D8-3C6E8A7ED8BC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "15D63E08-D7E4-4960-B4A3-9BEBA6150CA7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.7.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "03BBE4F6-35E8-4935-B657-651D3D822890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.7.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "6A62DCAD-3C28-4595-9095-90DBA3944BF4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:1.7.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "0064F204-3F3F-4E32-8104-A15ECC8464D3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DBF799AE-6BDA-43E9-B841-DAD6A3CC34F9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "37DF27D2-E4CB-4A49-8D42-F41ED29136C4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "ABB57804-F8DA-4366-9B75-E5241D137352",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "9C51558C-4DF9-4D62-A679-64361E584802",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "E7C6E6DE-B5AC-48FA-A6EE-CF1C596D34BA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "452E5E75-FD84-436E-A51B-793346A1456C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "C19CE4F7-2033-44E7-BBD2-70D451692E37",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "53297CBE-F8E4-4BFF-BC49-51E7F26E11B8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "DA9B8AE0-F86A-4362-BF9E-A04C8BF801B8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "3E621568-52A8-4DCB-B0E4-0C40E0DB06F6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "146C7D99-8B0C-44A0-96E0-C8FBBB5F4567",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.0.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC5D9559-C2C7-405E-8874-47B227D3CF1F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E0E85CC3-7B91-4ABE-A011-7167339F8EB6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "0BCC087E-7ACA-4DE6-B8BF-43BECCB3049C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "608D7317-53DE-4CAB-B396-3C7A6C6B418F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "07B2CA8C-4B5E-46AF-A9AF-1B35AD63FF46",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "886DF3A9-A97E-4C89-8EBF-F6A5872F26BC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "7024F414-7E9A-4FD9-9B34-EB0A5D820E87",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.1.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "068DE0CF-6D52-434D-A118-4D346014B07F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F816C962-4FC3-4763-96BB-15EB27B367D3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "BD204EAB-344D-4569-BB17-3E7C2A5EA92A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "CBCC5440-AD21-47F4-BE33-898302981AC0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "96AC8E7D-5718-42F6-9829-59996D18EDFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "A58D540A-4786-411D-AF4F-020120AA65A2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.2.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F55F438-AF9D-405C-A1E6-758DE74EFC65",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "03F4C388-E6B2-40C5-8C3C-DDD80D619F27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "700425A6-CAF3-4ED5-8517-40FDB2450E49",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "EED818B6-30DE-46C6-B240-FC9B5E5C6A78",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "FF463F04-8ED6-42A8-9B23-ADD85EE6FE76",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "3F1B61AB-ECE7-4E89-9059-2066F08F67AD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.3.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "BB10D77F-38E8-4164-A651-399DFB6A4AD5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "21F1DB20-11A1-4145-8F7F-52CD3B07F0F8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "F41E5444-FDC0-47DF-8C4F-6AC69FFFED73",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "F79451CF-562C-4DC1-B03F-7FA354E6C36C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "DE24EE64-5390-4DFD-A5E4-42F5C2D5D609",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "F8474722-3819-418E-9C7E-FADC5EEE3D58",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:2.4.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "C33A514B-739F-4A78-A868-19860A2F4BCA",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de salto de directorio en install.php en Piwigo anterior a v2.4.7 que permite a atacantes remotos leer y eliminar ficheros arbitrarios a través de .. (punto punto) en el parámetro dl.",
      },
   ],
   id: "CVE-2013-1469",
   lastModified: "2024-11-21T01:49:39.627",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "HIGH",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:H/Au:N/C:P/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 4.9,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2013-03-13T20:55:02.750",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://piwigo.org/bugs/view.php?id=0002843",
      },
      {
         source: "cve@mitre.org",
         url: "http://piwigo.org/forum/viewtopic.php?id=21470",
      },
      {
         source: "cve@mitre.org",
         url: "http://piwigo.org/releases/2.4.7",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "http://www.exploit-db.com/exploits/24561",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "https://www.htbridge.com/advisory/HTB23144",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://piwigo.org/bugs/view.php?id=0002843",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://piwigo.org/forum/viewtopic.php?id=21470",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://piwigo.org/releases/2.4.7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "http://www.exploit-db.com/exploits/24561",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "https://www.htbridge.com/advisory/HTB23144",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-22",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE6825BB-C574-480F-92B6-5A7D8E70BFD9",
                     versionEndExcluding: "11.4.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.",
      },
      {
         lang: "es",
         value: "Una inyección SQL se presenta en Piwigo versiones anteriores a 11.4.0, por medio del parámetro language en admin.php?page=languages.",
      },
   ],
   id: "CVE-2021-27973",
   lastModified: "2024-11-21T05:58:56.550",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.2,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-04-02T19:15:20.880",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1352",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://packetstormsecurity.com/files/162404/Piwigo-11.3.0-SQL-Injection.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/Piwigo/Piwigo/issues/1352",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}