Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-10 | 1 | Disclosure1 |
| 2026-03-23 | 1 | General1 |
@rez0__ I should to do a video of my 3 CVEs with a Bugtraceai framework for 2 dollars run. Wallos High: https://www.cve.org/CVERecord?id=CVE-2026-27479 ZoneMinder High: https://www.cve.org/CVERecord?id=CVE-2026-27470 Piwigo Medium: https://www.cve.org/CVERecord?id=CVE-2026-27834
Post summary
The user references three CVEs and plans to create a video using Bugtraceai, but no PoC, exploit, or technical details are provided.
@carlosazaustre Y donde han puesto los CVEs que encontraron? yo te paso los que encontré con BugTraceAI Wallos - High https://www.cve.org/CVERecord?id=CVE-2026-27479 ZoneMinder - High https://www.cve.org/CVERecord?id=CVE-2026-27470 Piwigo (Pendiente de Disclosure) - High CVE-2026-27834
Post summary
The tweet announces several newly discovered CVEs (CVE-2026-27479, CVE-2026-27470, CVE-2026-27834) with a high severity rating, providing links to their CVE records and noting a pending disclosure for one of them.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | piwigo | piwigo | - | - | - |