CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php.

• CWE-89

• http://packetstormsecurity.com/files/130440/Piwigo-2.7.3-SQL-Injection.htmlExploit
• http://piwigo.org/forum/viewtopic.php?id=25179Vendor Advisory
• http://piwigo.org/releases/2.7.4Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/534723/100/0/threaded
• http://www.securityfocus.com/bid/72664
• http://packetstormsecurity.com/files/130440/Piwigo-2.7.3-SQL-Injection.htmlExploit
• http://piwigo.org/forum/viewtopic.php?id=25179Vendor Advisory
• http://piwigo.org/releases/2.7.4Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/534723/100/0/threaded
• http://www.securityfocus.com/bid/72664

Published

Feb 20, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1503Multiple directory traversal vulnerabilities in IceWarp Mail…
• CVE-2015-1512Multiple cross-site scripting (XSS) vulnerabilities in Fancy…
• CVE-2015-1513SQL injection vulnerability in SIPhone Enterprise PBX allows…
• CVE-2015-1514Multiple SQL injection vulnerabilities in FancyFon FAMOC bef…
• CVE-2015-1515The dwall.sys driver in SoftSphere DefenseWall Personal Fire…
• CVE-2015-1516Cross-site scripting (XSS) vulnerability in Polycom RealPres…
• CVE-2015-1518SQL injection vulnerability in the search_post function in i…
• CVE-2015-1521analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not …
• CVE-2015-1522analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not …
• CVE-2015-1525audio/AudioPolicyManagerBase.cpp in Android before 5.1 allow…5.5
• CVE-2015-1526The media_server component in Android allows remote attacker…
• CVE-2015-1527Integer overflow in IAudioPolicyService.cpp in Android allow…