PT-2026-21770 · Piwigo · Piwigo

Published 2026-02-24 · Updated 2026-03-25 · CVE-2025-62512

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 15.5.0

Description Piwigo is a photo gallery application for the web. The password reset functionality allows an unauthenticated attacker to determine if a given username or email address exists in the system. The /password.php?action=lost API endpoint returns different messages depending on whether the account exists, enabling user enumeration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-62512

GHSA-H4WX-7M83-XFXC

Affected Products

Piwigo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62512.json · Exploit
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62512 · Security Note
• https://twitter.com/CVEnew/status/2026676445695848469 · Twitter Post
• https://t.me/CVEtracker/45625 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2036624146147561580 · Twitter Post