Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2024-43018: Piwigo versions 13.8.0 and below allow attackers to manipulate user search results
CVE-2024-43018 · published 1 year ago
Summary
If you use Piwigo, a photo gallery software, attackers may be able to manipulate search results for users on your site. This is because the software doesn't properly check user input in certain areas. To protect your site, update to the latest version of Piwigo.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| piwigo | piwigo |
<= 13.8.0 cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* |
Original advisory text
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.p...
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.
References
- https://github.com/Piwigo/Piwigo/issues/2197 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43018... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-43018 Vendor Advisory
- https://github.com/inesmarcal/CVE-2024-43018 Product
- https://github.com/joaosilva21/CVE-2024-43018 Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published29 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta