Description
Cross-site scripting (XSS) vulnerability in admin/picture_modify.php in the photo-edit subsystem in Piwigo 2.6.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the associate[] field, a different vulnerability than CVE-2014-4649.
References
- http://piwigo.org/bugs/view.php?id=3089
- JVN#09717399 third-party-advisory
- http://piwigo.org/dev/changeset/28678
- JVNDB-2014-000093 third-party-advisory