CVE-2018-6883: Piwigo

Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days.

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.

Affected products

• Piwigo Piwigo: before 2.9.3 (fixed in 2.9.3)

Published 2018-02-24. Last modified 2026-06-17.