{"schema_version":"1","data":[{"id":3947,"advisory_id":"04112a45-452c-4db7-8073-024cf9042e73","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62262","source_published_at":"2026-09-25T15:46:04.598+00:00","published_at":"2026-10-24T21:43:23.1848+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-62262"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`","summary":"Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows error-based or blind extraction of database information and database-dependent time delays through the public search flow. No fixed version is available as of this review.","evidence":"cve:CVE-2026-62262","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-62262","aliases":["CVE-2026-62262"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"< 17.0.0beta1"}]}],"modified":"2026-09-29T19:19:31.528Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","https://github.com/Piwigo/Piwigo/commit/9755d88edf38b94bafdedb0b3aba7304a94e2e5c","https://github.com/Piwigo/Piwigo/commit/aede490a0b3a6c246f1f4689ca86c8fee377a7ae"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62262","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T19:19:06.002386Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hq29-8hhx-5jwc","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T19:19:31.528Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T15:46:04.598Z"}}},"related_cves":[{"value":"CVE-2026-62262","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3139,"advisory_id":"ab3dd6d7-0dce-4ba5-ae4f-9faf9bab8a42","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42323","source_published_at":"2026-09-25T15:42:01.688+00:00","published_at":"2026-10-24T21:30:35.250128+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-42323"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo: SQL Injection in Batch Manager","summary":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.","evidence":"cve:CVE-2026-42323","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-42323","aliases":["CVE-2026-42323"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"< 16.4.0"}]}],"modified":"2026-09-28T14:29:29.756Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c","https://github.com/Piwigo/Piwigo/commit/c7e30da5c1775b531ce9a30aac04134cd714b472","https://github.com/Piwigo/Piwigo/commit/e4f0989d350d66207066ea61f8ee8c137164fb2f","https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42323","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T14:29:23.227256Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T14:29:29.756Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T15:42:01.688Z"}}},"related_cves":[{"value":"CVE-2026-42323","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3136,"advisory_id":"af3f0846-7813-4cc0-8c6e-e1687cd7751c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42322","source_published_at":"2026-09-25T15:50:34.662+00:00","published_at":"2026-10-24T21:30:32.675932+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-42322"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo: Authenticated RCE via File Upload in Logo Upload Feature","summary":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed in the web-accessible logo directory and executed when requested if the web server handles that extension. This can permit arbitrary command execution, data disclosure, modification, persistence, and service disruption. This vulnerability is fixed in 16.4.0.","evidence":"cve:CVE-2026-42322","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-42322","aliases":["CVE-2026-42322"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"< 16.4.0"}]}],"modified":"2026-09-28T14:34:50.653Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv","https://github.com/Piwigo/Piwigo/commit/1e7f7262cb30e6916779f93e66d5d6579ec75a11","https://github.com/Piwigo/Piwigo/commit/4a13ec9a8f4881ae1f23bdfd24d7b90cd0802cdc","https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42322","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T14:34:42.659667Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7w97-5g4p-xqvv","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T14:34:50.653Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T15:50:34.662Z"}}},"related_cves":[{"value":"CVE-2026-42322","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2172,"advisory_id":"b21577cb-a32a-4375-a320-4448d262de0d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-44642","source_published_at":"2026-09-25T15:47:59.389+00:00","published_at":"2026-10-24T21:13:43.605379+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-44642"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)","summary":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0.","evidence":"cve:CVE-2026-44642","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-44642","aliases":["CVE-2026-44642"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"< 16.4.0"}]}],"modified":"2026-09-25T16:41:02.238Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm","https://github.com/Piwigo/Piwigo/commit/1ff9d04534feb5f8f3cc2d3613c0fe8b51a1c0ba","https://github.com/Piwigo/Piwigo/commit/2cfa7a3d194c8b95edde43038d8f5be5a359e785","https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-44642","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T16:40:38.942377Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T16:41:02.238Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T15:47:59.389Z"}}},"related_cves":[{"value":"CVE-2026-44642","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2141,"advisory_id":"76a75bed-bb4e-406f-a377-1ed342e4cc38","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42324","source_published_at":"2026-09-25T15:48:55.894+00:00","published_at":"2026-10-24T21:13:24.675925+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-42324"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo: Second-Order SQL Injection","summary":"Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.","evidence":"cve:CVE-2026-42324","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-42324","aliases":["CVE-2026-42324"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"< 16.4.0"}]}],"modified":"2026-09-25T16:15:01.123Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q","https://github.com/Piwigo/Piwigo/commit/ba1f803f8cefd3602ccb9c6f0155cd529510288a","https://github.com/Piwigo/Piwigo/commit/ef9e65386d76f9c85f1e23a45dd7af14a5b73a47","https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-42324","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T16:14:12.579220Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-jhp4-7f82-8f6q","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T16:15:01.123Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T15:48:55.894Z"}}},"related_cves":[{"value":"CVE-2026-42324","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2110,"advisory_id":"f2405924-dd79-4b0e-befd-1005c920ce96","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85750","source_published_at":"2026-09-25T13:51:07.771+00:00","published_at":"2026-10-24T21:13:06.345249+00:00","extraction_method":"structured","technologies":["core-cve","piwigo"],"cve_ids":["CVE-2026-85750"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Piwigo arbitrary file read and remote code execution via insecure image processing","summary":"Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0.","evidence":"cve:CVE-2026-85750","products":[{"name":{"value":"Piwigo","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85750","aliases":["CVE-2026-85750"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Piwigo","product":"Piwigo","versions":[{"status":"affected","version":"<= 16.3.0"}]}],"modified":"2026-09-25T14:42:29.975Z","provider":"cve","references":["https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw","https://www.helx.io/en/blog/advisory-piwigo"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85750","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T14:38:16.238956Z"}}}],"references":[{"url":"https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T14:42:29.975Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T13:51:07.771Z"}}},"related_cves":[{"value":"CVE-2026-85750","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":3947,"next_before":2110}