CVE-2016-10514

url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

• CWE-284

• http://piwigo.org/releases/2.8.3Patch, Release Notes, Vendor Advisory
• https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57Issue Tracking, Patch, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issues/547Issue Tracking, Patch, Third Party Advisory
• http://piwigo.org/releases/2.8.3Patch, Release Notes, Vendor Advisory
• https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57Issue Tracking, Patch, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issues/547Issue Tracking, Patch, Third Party Advisory

Published

Oct 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10509SQL injection vulnerability in the updateAmazonOrderTracking…
• CVE-2016-1051Use-after-free vulnerability in Adobe Reader and Acrobat bef…
• CVE-2016-10510Cross-site scripting (XSS) vulnerability in the Security com…
• CVE-2016-10511The Twitter iOS client versions 6.62 and 6.62.1 fail to vali…
• CVE-2016-10512MultiTech FaxFinder before 4.1.2 stores Passwords unencrypte…
• CVE-2016-10513Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via…
• CVE-2016-10515In Redmine before 3.2.3, there are stored XSS vulnerabilitie…
• CVE-2016-10516Cross-site scripting (XSS) vulnerability in the render_full …
• CVE-2016-10517networking.c in Redis before 3.2.7 allows "Cross Protocol Sc…
• CVE-2016-10518A vulnerability was found in the ping functionality of the w…
• CVE-2016-10519A security issue was found in bittorrent-dht before 5.1.3 th…
• CVE-2016-1052Use-after-free vulnerability in Adobe Reader and Acrobat bef…