CVE-2009-2933

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the items_number parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/36333Vendor Advisory
http://www.securityfocus.com/archive/1/505801/100/0/threaded
http://www.senseofsecurity.com.au/advisories/SOS-09-007.pdfURL Repurposed
http://secunia.com/advisories/36333Vendor Advisory
http://www.securityfocus.com/archive/1/505801/100/0/threaded
http://www.senseofsecurity.com.au/advisories/SOS-09-007.pdfURL Repurposed

Timeline

Published: Aug 21, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-29349.3Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attackers to execute arbitr CVE-2009-293510.0Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possib CVE-2009-29367.5The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before CVE-2009-29374.3Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via t CVE-2009-29396.9The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/post CVE-2009-29407.5The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers t CVE-2009-29427.5The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers t CVE-2009-29437.5The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which m CVE-2009-29445.0Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers CVE-2009-29454.3weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certa CVE-2009-29469.3Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via cr CVE-2009-29474.3Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via un