Piwigo

Products

Exploited and recent CVEs

• CVE-2026-42322 Critical 9.1 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature 1.3%
• CVE-2026-42324 High 7.2 Piwigo: Second-Order SQL Injection 0.9%
• CVE-2026-44642 High 8.1 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+) 1.3%
• CVE-2026-62262 Critical 9.1 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` 0.7%
• CVE-2026-42323 High 7.2 Piwigo: SQL Injection in Batch Manager 0.9%
• CVE-2026-85750 High 7.2 Piwigo arbitrary file read and remote code execution via insecure image processing 1.2%
• CVE-2026-35048 Critical 9.8 Piwigo RCE via PHP Code Injection into Config File in Installer 0.6%
• CVE-2026-27885 High 7.2 Piwigo: SQL Injection in Activity.getList 0.4%
• CVE-2026-27834 High 7.2 Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter 0.4%
• CVE-2026-27833 High 7.5 Piwigo: Unauthenticated Information Disclosure via pwg.history.search API 1.6%
• CVE-2026-27634 High 8.7 Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter 0.7%
• CVE-2025-62512 Medium 5.5 Piwigo Vulnerable to User Enumeration via Password Reset Endpoint 0.8%
• CVE-2024-48928 Low 2.7 Piwigo's secret key can be brute forced 0.3%
• CVE-2025-62406 High 8.1 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link 0.4%
• CVE-2023-44393 Critical 9.3 Piwigo Reflected XSS vulnerability 1.3%
• CVE-2023-37270 High 7.6 Piwigo SQL Injection vulnerability in "User-Agent" 4.5%