Description

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

Remediation

References

CVE-2016-10514

Related Vulnerabilities

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-1134)

Oracle HTTP Server Improper Access Control Vulnerability (CVE-2026-21962)

WordPress Plugin Media Tagz Gallery Multiple Unspecified Vulnerabilities (1.0)

Perl Out-of-bounds Write Vulnerability (CVE-2024-56406)

WordPress Plugin Inline Related Posts Multiple Cross-Site Scripting Vulnerabilities (3.0.4)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2016-10514