Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-62262 - Vulnerability Database
Piwigo

Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-62262

Information
Reference: CVE-2026-62262
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-62262
Title: Piwigo : Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne
Overview:

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier when rating is enabled an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules and include/functions_search.inc.php integer-casts only the lower rating bound while concatenating the raw value as the SQL upper bound. This allows