Vulnerabilidades em Piwigo
18 resultadosAnálise Vexday
Piwigo apresenta 10 vulnerabilidades catalogadas, com 2 críticas e nenhuma atualmente sob ataque ativo, reduzindo o risco imediato. A fraqueza dominante é injeção SQL (CWE-89), padrão clássico em aplicações web, requerindo atenção especial em validação de entrada. O ritmo de descobertas é moderado, com apenas 1 CVE publicada nos últimos 90 dias, sugerindo risco estabilizado.
CVE-2023-37270HIGHPiwigo SQL Injection vulnerability in "User-Agent"EPSS 4.5%CVE-2026-27833HIGHPiwigo: Unauthenticated Information Disclosure via pwg.history.search APIEPSS 1.7%CVE-2023-44393CRITICALPiwigo Reflected XSS vulnerabilityEPSS 1.3%CVE-2026-44642HIGHPiwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)EPSS 1.3%CVE-2012-4525—piwigo has XSS in password.phpEPSS 1.2%CVE-2026-85750HIGHPiwigo arbitrary file read and remote code execution via insecure image processingEPSS 1.2%CVE-2012-4526—piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)EPSS 1.2%CVE-2026-42324HIGHPiwigo: Second-Order SQL InjectionEPSS 0.9%CVE-2026-27634HIGHPiwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filterEPSS 0.8%CVE-2025-62512MEDIUMPiwigo Vulnerable to User Enumeration via Password Reset EndpointEPSS 0.8%CVE-2026-35048CRITICALPiwigo RCE via PHP Code Injection into Config File in InstallerEPSS 0.6%CVE-2026-27885HIGHPiwigo: SQL Injection in Activity.getListEPSS 0.5%CVE-2026-27834HIGHPiwigo: SQL Injection in pwg.users.getList API Method via filter ParameterEPSS 0.5%CVE-2026-42322CRITICALPiwigo: Authenticated RCE via File Upload in Logo Upload FeatureEPSS 0.5%CVE-2025-62406HIGHPiwigo is vulnerable to one-click account takeover by modifying the password-reset linkEPSS 0.4%CVE-2026-42323HIGHPiwigo: SQL Injection in Batch ManagerEPSS 0.4%CVE-2026-62262CRITICALPiwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`EPSS 0.3%CVE-2024-48928LOWPiwigo's secret key can be brute forcedEPSS 0.3%