CVE-2019-13363

admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit parameter. This is exploitable via CSRF.

• CWE-79
• CWE-352

• http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Sep/25Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Jun/29Exploit, Mailing List, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issuesIssue Tracking, Product
• https://piwigo.comProduct
• http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Sep/25Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Jun/29Exploit, Mailing List, Third Party Advisory
• https://github.com/Piwigo/Piwigo/issuesIssue Tracking, Product
• https://piwigo.comProduct

Published

Sep 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13358lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE th…7.5
• CVE-2019-13359In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836,…
• CVE-2019-1336An elevation of privilege vulnerability exists in the Micros…7.8
• CVE-2019-13360In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836,…
• CVE-2019-13361Smanos W100 1.0.0 devices have Insecure Permissions, exploit…6.5
• CVE-2019-13362Codedoc v3.2 has a stack-based buffer overflow in add_variab…
• CVE-2019-13364admin.php?page=account_billing in Piwigo 2.9.5 has XSS via t…9.6
• CVE-2019-13367Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-13368Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-13369Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1337An information disclosure vulnerability exists when Windows …5.5
• CVE-2019-13370index.php/admin/permissions in Ignited CMS through 2017-02-1…8.8