Description
Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
Remediation
References
Related Vulnerabilities
Oracle Database Server Uncontrolled Resource Consumption Vulnerability (CVE-2026-46835)
Oracle Database Server CVE-2008-2591 Vulnerability (CVE-2008-2591)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-3190)
Drupal Core 9.1.x Multiple Security Bypass Vulnerabilities (9.1.0 - 9.1.12)
WordPress Plugin Simple Personal Message SQL Injection (1.0.3)