Description

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

Remediation

References

CVE-2016-10514

Related Vulnerabilities

WordPress Plugin WP Custom Fields Search Cross-Site Scripting (1.2.34)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-8624)

WordPress Plugin Ad Inserter-Ad Manager & AdSense Ads Cross-Site Scripting (1.5.5)

MySQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-0001)

WordPress 5.5.x Multiple Vulnerabilities (5.5 - 5.5.12)

Severity

Medium

Classification

CVE-2016-10514 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities