D4Wner

The issue allows for XSS via the `sdm upload thumbnail` parameter in an edit action to the "/wp-admin/post.php" endpoint. This affects the plugin's functionality related to file thumbnails.

The issue allows for XSS via the `sdm upload` parameter in an edit action to the "wp-admin/post.php" endpoint. This affects the WordPress plugin, potentially allowing malicious actions.

The issue concerns an XSS vulnerability. It can be exploited via the `datepicker` parameter in the "results.php" endpoint or the `spemail` parameter in the "admin/new master.php" endpoint.

The issue is related to a CSRF vulnerability. It affects the admin/new master.php endpoint.

The issue concerns SQL Injection, which can be exploited via specific parameters in certain PHP files. The vulnerable parameters are `sp id` in the "admin/view seatseller.php" endpoint and `memid` in the "admin/view member.php" endpoint.

The issue allows an attacker to perform Cross-Site Request Forgery attacks, potentially coercing an admin user into performing unintended actions. This can be achieved via the "admin.php?page=configuration&section=main" or "admin.php?page=batch manager&mode=unit" API endpoints.

The issue affects the admin/configuration.php file in Piwigo, where a CSRF (Cross-Site Request Forgery) weakness is present.

The issue allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. The vendor has expressed that they do not consider an attacker with access to manage/upload themes a significant threat model.