CVE-2024-46606

MediumCVSS 5.4

Published: 16/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in Piwigo version 14.5.0 in the /admin.php?page=photo component. An attacker can inject malicious JavaScript or HTML into the Description field, leading to arbitrary script execution in the victim's browser.

Risk Assessment

The risk includes potential session hijacking of administrators, data theft, or malware distribution by displaying a crafted photo description.

Recommendation

Immediately update Piwigo to the latest version and apply input filtering for text fields, especially the photo description.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.