CVE-2024-28662: Piwigo

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.

Affected products

• Piwigo Piwigo: version 14.2.0 only

Published 2024-03-13. Last modified 2026-06-17.