CVE-2024-48311

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 31, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-483125.4WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.CVE-2024-483228.1UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.CVE-2024-483258.1Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. ThCVE-2024-483368.4The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, whCVE-2024-483413.7dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShopCVE-2024-483436.3A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSeaCVE-2024-483466.1xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered tCVE-2024-48358.2A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condCVE-2024-483527.5Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterCVE-2024-483537.5Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintexCVE-2024-483569.8LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.CVE-2024-483579.8LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
CVE-2024-48311: High severity, CVSS 8.8 | Vulnix