CVE-2020-9467

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-94684.3The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, CVE-2020-94707.8An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local usCVE-2020-94718.8Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.CVE-2020-94726.5Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.CVE-2020-94736.6The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with acceCVE-2020-94748.8The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. ByCVE-2020-94757.0The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an CVE-2020-94767.5ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performingCVE-2020-94779.8An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interCVE-2020-94788.8An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arbCVE-2020-94795.5When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affectedCVE-2020-94809.8In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) v
CVE-2020-9467: Medium severity, CVSS 5.4 | Vulnix