CVE-2024-46606

MediumCVSS 5.4/10Last modified Jul 5, 2026

Description

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2024
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-466077.6Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and p CVE-2024-466097.5An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to acce CVE-2024-46614.3The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax func CVE-2024-466107.5An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and passwo CVE-2024-466129.8IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.CVE-2024-466139.8WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items CVE-2024-46628.8The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata CVE-2024-466229.8An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8 CVE-2024-466248.8An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload se CVE-2024-466258.8An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers t CVE-2024-466268.8OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.CVE-2024-466279.1Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.