CVE-2020-9467

medium · 5.4

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.

5.4

CVSS

23.8%

EPSS (exploit prob.)

98th

EPSS percentile

2020-03-26

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Vendor	Product	Affected versions
piwigo	piwigo	2.10.1

Check a specific version with /api/v1/cve/match.

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-9467