Sploitus

CVE-2019-13363

3 known exploits for CVE-2019-13363

admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.

Affected products
Piwigo
Piwigo
= 2.9.5
CVSS 3.1
9.6 CRITICAL
EPSS
1.4% (70th percentile)
Weakness
CWE-352, CWE-79
NVD status
Modified
Published
2019-09-13
CVE-2019-13363 at NVD
Authoritative description, scoring and affected products

3 known exploits for CVE-2019-13363

Proof-of-concept code and exploit modules indexed by Sploitus

Gila CMS 1.11.5 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities
2020-06-24 Rodolfo TavaresZDT
GilaCMS 1.11.5 Cross Site Request Forgery / Cross Site Scripting
2020-06-23 Rodolfo TavaresPACKETSTORM
Piwigo 2.9.5 Cross Site Request Forgery / Cross Site Scripting
2019-09-13 Rodolfo TavaresPACKETSTORM