Description

The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible.

Remediation

References

CVE-2018-7723

Related Vulnerabilities

WebLogic CVE-2020-14637 Vulnerability (CVE-2020-14637)

Joomla CVE-2006-4469 Vulnerability (CVE-2006-4469)

Liferay Portal Insecure Default Initialization of Resource Vulnerability (CVE-2023-33949)

Internet Information Services Other Vulnerability (CVE-1999-0449)

MongoDb Other Vulnerability (CVE-2020-7929)

Severity

Medium

Classification

CVE-2018-7723 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities