Description

admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).

Remediation

References

CVE-2016-10084

Related Vulnerabilities

WordPress 5.8.x Multiple Vulnerabilities (5.8 - 5.8.8)

WordPress Plugin Rating-Widget:Star Review System Cross-Site Scripting (2.8.8)

Django Uncontrolled Resource Consumption Vulnerability (CVE-2019-14233)

WordPress Plugin WP eCommerce 'wpsc-transaction_results_functions.php' SQL Injection (3.8.7.5)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-5590)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2016-10084