Xcold

**Name of the Vulnerable Software and Affected Versions** Piwigo versions prior to 2.9.3 **Description** The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The "tags.php" endpoint is affected, specifically the `edit list` parameter, which is not sanitized and is used to construct an SQL query to retrieve a list of registered users into the application. **Recommendations** For Piwigo version 2.9.2 and possibly prior, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the "tags.php" endpoint or sanitizing the `edit list` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BigTree CMS versions prior to 4.2.20 **Description** A SQL injection issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack involves an admin/trees/add/process request with a crafted ` tags[]` parameter that is mishandled in a later admin/ajax/dashboard/approve-change request. **Recommendations** For BigTree CMS versions prior to 4.2.20, update to version 4.2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/trees/add/process and admin/ajax/dashboard/approve-change requests to minimize the risk of exploitation. Avoid using the ` tags[]` parameter in the affected requests until the issue is resolved.