Advisories · Technology

Piwigo.

Every CVE that names Piwigo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-42322 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
- Piwigo
- Unrestricted file upload
Not analysed yet 25 Sept 2026
CVE-2026-42324 CVE record

CVSS 7.2 High

Piwigo: Second-Order SQL Injection
- Piwigo
- SQL injection
Not analysed yet 25 Sept 2026
CVE-2026-44642 CVE record

CVSS 8.1 High

Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)
- Piwigo
- SQL injection
Not analysed yet 25 Sept 2026
CVE-2026-62262 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
- Piwigo
- SQL injection
Not analysed yet 25 Sept 2026
CVE-2026-42323 CVE record

CVSS 7.2 High

Piwigo: SQL Injection in Batch Manager
- Piwigo
- SQL injection
Not analysed yet 25 Sept 2026
CVE-2026-85750 CVE record

CVSS 7.2 High

Piwigo arbitrary file read and remote code execution via insecure image processing
- Piwigo
- CWE-20
Not analysed yet 25 Sept 2026
CVE-2026-84441 CVE record

CVSS 6.9 Medium

Piwigo Image Derivative i.php path traversal
- Piwigo
- Path traversal
Not analysed yet 2 Sept 2026
CVE-2026-78187 CVE record

CVSS 2.3 Low

Piwigo Public Authentication cross site scripting
- Piwigo
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 24 Aug 2026
CVE-2026-35048 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Piwigo RCE via PHP Code Injection into Config File in Installer
- Piwigo
- CWE-20
Not analysed yet 20 Jul 2026
CVE-2026-27885 CVE record

CVSS 7.2 High

Piwigo: SQL Injection in Activity.getList
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-27834 CVE record

CVSS 7.2 High

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-27833 CVE record

CVSS 7.5 High

Piwigo: Unauthenticated Information Disclosure via pwg.history.search API
- Piwigo
- Broken access control
Not analysed yet 3 Apr 2026
CVE-2026-27634 CVE record

CVSS 8.7 High

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2025-62512 CVE record

CVSS 5.5 Medium

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
- Piwigo
- CWE-204
Not analysed yet 24 Feb 2026
CVE-2024-48928 CVE record

CVSS 2.7 Low

Piwigo's secret key can be brute forced
- Piwigo
- Weak cryptography or TLS
Not analysed yet 24 Feb 2026
CVE-2025-62406 CVE record

CVSS 8.1 High

Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
- Piwigo
- CWE-640
Not analysed yet 18 Nov 2025
CVE-2023-44393 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Piwigo Reflected XSS vulnerability
- Piwigo
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2023
CVE-2023-37270 CVE record

CVSS 7.6 High

Piwigo SQL Injection vulnerability in "User-Agent"
- Piwigo
- SQL injection
Not analysed yet 7 Jul 2023
CVE-2016-3735 CVE record

Piwigo is image gallery software written in PHP.
- Piwigo
- CWE-335
Not analysed yet 28 Jan 2022
CVE-2012-4526 CVE record

piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
- piwigo
Not analysed yet 2 Dec 2019
CVE-2012-4525 CVE record

piwigo has XSS in password.php
- piwigo
Not analysed yet 2 Dec 2019