CVE-2026-62262Critical· 9.1▾ MidnightPiwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then o…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42324High· 7.2Piwigo is a full featured open source photo gallery application for the web
CVE-2026-42323High· 7.2Piwigo is a full featured open source photo gallery application for the web
CVE-2026-44642High· 8.1Piwigo is a full featured open source photo gallery application for the web
CVE-2026-42322Critical· 9.1Piwigo is a full featured open source photo gallery application for the web
CVE-2026-85750High· 7.2Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files
CVE-2025-15392Medium· 6.3A weakness has been identified in Kohana KodiCMS up to 13.82.135