A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
piwigo has XSS in password.php