CVE-2016-10084

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/95164Third Party Advisory, VDB Entry
https://github.com/Piwigo/Piwigo/commit/9dd92959f6975099e0c62163a846a4648a6a920fIssue Tracking, Patch, Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/572#issuecomment-268252202Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95164Third Party Advisory, VDB Entry
https://github.com/Piwigo/Piwigo/commit/9dd92959f6975099e0c62163a846a4648a6a920fIssue Tracking, Patch, Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/572#issuecomment-268252202Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Dec 30, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-100857.2admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab paramet CVE-2016-100868.1RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or m CVE-2016-100877.5The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.CVE-2016-100887.0The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option i CVE-2016-100897.8Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-20 CVE-2016-10099.8Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Contin CVE-2016-100917.5Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to t CVE-2016-100927.8Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0 CVE-2016-100937.8Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4 CVE-2016-100947.8Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecifi CVE-2016-100955.5Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0,CVE-2016-100967.3SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activ