CVE-2023-44393

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.

• CWE-79
• CWE-80

• https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23Patch
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vggExploit, Third Party Advisory
• https://github.com/Piwigo/Piwigo/commit/cc99c0f1e967c5f1722a0cce30ff42374a7bbc23Patch
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-qg85-957m-7vggExploit, Third Party Advisory

Published

Oct 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-44388Discourse is an open source platform for community discussio…7.5
• CVE-2023-44389Zope is an open-source web application server. The title pro…4.8
• CVE-2023-4439A vulnerability was found in SourceCodester Card Holder Mana…5.3
• CVE-2023-44390HtmlSanitizer is a .NET library for cleaning HTML fragments …6.1
• CVE-2023-44391Discourse is an open source platform for community discussio…5.3
• CVE-2023-44392Garden provides automation for Kubernetes development and te…9
• CVE-2023-44394MantisBT is an open source bug tracker. Due to insufficient …4.3
• CVE-2023-44395Autolab is a course management service that enables instruct…6.5
• CVE-2023-44396iTop is an IT service management platform. Dashlet edits aj…5.4
• CVE-2023-44397CloudExplorer Lite is an open source, lightweight cloud mana…9.8
• CVE-2023-44398Exiv2 is a C++ library and a command-line utility to read, w…8.8
• CVE-2023-44399ZITADEL provides identity infrastructure. In versions 2.37.2…5.3