CVE-2024-43018: Piwigo

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list.

Affected products

• Piwigo Piwigo: up to and including 13.8.0

Published 2025-07-29. Last modified 2026-06-17.