Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.

Remediation

References

CVE-2014-4614

Related Vulnerabilities

WordPress Plugin Chamber Dashboard Business Directory Cross-Site Scripting (3.2.8)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-43708)

Magento Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-7139)

MySQL CVE-2020-2584 Vulnerability (CVE-2020-2584)

MySQL CVE-2012-2750 Vulnerability (CVE-2012-2750)

Severity

Medium

Classification

CVE-2014-4614 CWE-352

Tags

Missing Update Known Vulnerabilities