PT-2025-31256 · Piwigo · Piwigo

Published 2025-07-27 · Updated 2025-07-30 · CVE-2024-43018

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Piwigo versions 13.8.0 and below

Description Piwigo versions 13.8.0 and below are vulnerable to SQL Injection in the parameters max level and min register. These parameters are used in the ws user gerList function from the file includews functionspwg.users.php. This function is called by the ws.php file and can be used for searching users in an advanced way via the /admin.php?page=user list endpoint.

Recommendations Upgrade to version 15.1.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-01842

CVE-2024-43018

Affected Products

Piwigo

References · 10

• 🔥 https://github.com/joaosilva21/CVE-2024-43018 · Exploit
• 🔥 https://github.com/inesmarcal/CVE-2024-43018 · Exploit
• https://github.com/Piwigo/Piwigo/issues/2197 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-43018 · Security Note
• https://bdu.fstec.ru/vul/2026-01842 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43018 · Vendor Advisory
• https://twitter.com/VolerionSec/status/1950313486342381947 · Twitter Post
• https://t.me/cveNotify/130245 · Telegram Post
• https://twitter.com/CVEnew/status/1950280457976705405 · Twitter Post
• https://t.me/CVEtracker/28699 · Telegram Post