CVE-2018-6883

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Piwigo/Piwigo/issues/839Third Party Advisory
https://pastebin.com/tPebQFy4Third Party Advisory
https://github.com/Piwigo/Piwigo/issues/839Third Party Advisory
https://pastebin.com/tPebQFy4Third Party Advisory

Timeline

Published: Feb 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-68859.8An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerabilit CVE-2018-68888.0An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forg CVE-2018-68898.8An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can po CVE-2018-68904.8Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.CVE-2018-68916.1Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-68929.8An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client applicati CVE-2018-68939.8controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module'CVE-2018-69005.4PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.CVE-2018-69025.4PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.CVE-2018-69038.8PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remo CVE-2018-69045.4PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.CVE-2018-69054.8The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin e