CVE-2015-1441

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://piwigo.org/forum/viewtopic.php?id=25016Vendor Advisory
http://piwigo.org/releases/2.5.6Patch, Vendor Advisory
http://piwigo.org/releases/2.6.5Patch, Vendor Advisory
http://piwigo.org/releases/2.7.3Patch, Vendor Advisory
http://secunia.com/advisories/62606
http://www.securityfocus.com/bid/72400
http://piwigo.org/forum/viewtopic.php?id=25016Vendor Advisory
http://piwigo.org/releases/2.5.6Patch, Vendor Advisory
http://piwigo.org/releases/2.6.5Patch, Vendor Advisory
http://piwigo.org/releases/2.7.3Patch, Vendor Advisory
http://secunia.com/advisories/62606
http://www.securityfocus.com/bid/72400

Timeline

Published: Feb 3, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-14427.5SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote CVE-2015-14438.8The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.CVE-2015-14444.3Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 b CVE-2015-14457.2HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.CVE-2015-144810.0The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware bef CVE-2015-144910.0Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with f CVE-2015-14507.5SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a catego CVE-2015-14513.5Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject ar CVE-2015-14527.8The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to CVE-2015-14535.0The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for at CVE-2015-14547.1Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain cert CVE-2015-14557.5Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL use