Description

SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field.

Remediation

References

CVE-2014-4649

Related Vulnerabilities

WordPress Plugin WP Statistics Cross-Site Scripting (12.6.5)

WordPress Plugin BLUE ORIGAMI CRM (Formerly Application Maker/APM-CRM edition) Cross-Site Scripting (1.5.15)

Drupal Core 6.x Multiple Cross-Site Scripting Vulnerabilities (6.0)

Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4198)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-7859)

Severity

Medium

Classification

CVE-2014-4649 CWE-138

Tags

Missing Update Known Vulnerabilities