CVE-2017-9836

Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name parameter to /admin.php (i.e., creating a virtual album).

Score

CVSS 3.0 4.8 Medium

Status

Modified - cve@mitre.org

Published

2017-06-24

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Piwigo (Piwigo)

References

• https://github.com/Piwigo/Piwigo/issues/716