Description

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.

Remediation

References

CVE-2018-6883

Related Vulnerabilities

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Security Bypass (3.1.1.4.1)

WordPress Plugin WP GPX Maps 'wp-gpx-maps_admin_tracks.php' Arbitrary File Upload (1.1.22)

WordPress Plugin Job Board Vanila Cross-Site Scripting (1.0)

WordPress Plugin Top 10-Popular posts for WordPress SQL Injection (2.4.3)

WordPress Plugin Count per Day Search Bar Cross-Site Scripting (3.2.2)

Severity

Medium

Classification

CVE-2018-6883 CWE-138 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities