CVE-2014-3900

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-17 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the associate[] field, a different vulnerability than CVE-2014-4649.

Affected products

Piwigo: through 2.6.3; 2.6.0, 2.6.1, 2.6.2

References

http://jvn.jp/en/jp/JVN09717399/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000093
http://piwigo.org/bugs/view.php?id=3089
http://piwigo.org/dev/changeset/28678
http://jvn.jp/en/jp/JVN09717399/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000093
http://piwigo.org/bugs/view.php?id=3089
http://piwigo.org/dev/changeset/28678

Get alerted when CVE-2014-3900 or the next vulnerability affects your stack