CVE-2019-13364

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Sep/25Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jun/29Exploit, Mailing List, Third Party Advisory
https://github.com/Piwigo/Piwigo/issuesIssue Tracking
https://piwigo.comProduct
http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Sep/25Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jun/29Exploit, Mailing List, Third Party Advisory
https://github.com/Piwigo/Piwigo/issuesIssue Tracking
https://piwigo.comProduct

Timeline

Published: Sep 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13375.5An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Cl CVE-2019-133708.8index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.CVE-2019-133729.8/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arb CVE-2019-133739.8An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL CVE-2019-133746.1A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100 CVE-2019-133759.8A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay CVE-2019-133766.5phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The C CVE-2019-133775.9The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of o CVE-2019-133798.8On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthen CVE-2019-13385.9A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTL CVE-2019-133806.1KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.CVE-2019-133827.8UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmit