CVE-2024-46605
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=album component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.
Risk Assessment
The risk includes potential session hijacking of administrators, data theft, or malware propagation within the organization through script injection in the admin panel.
Recommendation
Immediately update Piwigo to the latest available version and apply input filtering and sanitization on the album Description field.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.