PT-2026-30248

CVE-2026-27885

Published

2026-04-03

Updated

2026-07-24

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.3.0

Description An issue exists in the Activity List API endpoint that allows an authenticated administrator to perform a SQL Injection. This technique involves inserting malicious SQL code into a query to manipulate the database, enabling the extraction of sensitive information such as user credentials, email addresses, and all stored content.

Recommendations Update to version 16.3.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Chakradhar1228

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers