CVE-2017-17825

CVE-2017-17825 describes a persistent Cross-Site Scripting (XSS) vulnerability in the Batch Manager component of Piwigo 2.9.2. An authenticated attacker can inject malicious scripts through specific array parameters in an admin.php request, which are then stored and executed when other users view the affected page. This medium-severity vulnerability (CVSS 4.8) requires high privileges and user interaction, allowing an attacker to hijack a client's browser and access stored data. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.