CVE-2021-27973 describes a SQL injection vulnerability in Piwigo versions prior to 11.4.0, specifically exploitable via the 'language' parameter in admin.php?page=languages. This vulnerability carries a CVSSv3.1 score of 7.2 (High), indicating a high potential for impact on confidentiality, integrity, and availability, as it can be exploited remotely with low attack complexity, though it requires high privileges. While there is no evidence of active exploitation (not in KEV or Hot List), public exploit code (EDB-49818) exists, yet it has garnered minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 11.4.0CPE matchmatch criteria | cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.