Unscored CVE-2014-1980 EUVD-2014-2032GHSA-xfhj-62hp-rv2f

Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arb…

Published Aug 14, 2014 · Updated Aug 6, 2024 · Assigned by jpcert

Description

Cross-site scripting (XSS) vulnerability in include/functions_metadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin.

References

JVN#80310172 third-party-advisory
JVNDB-2014-000092 third-party-advisory
http://piwigo.org/bugs/view.php?id=2805