How severe is CVE-2014-4648?

CVE-2014-4648 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2014-4648 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-4648?

CVE-2014-4648 primarily affects Piwigo. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-4648?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2014-4648 published?

CVE-2014-4648 was published on 2014-06-28 and last updated on 2026-06-17.

CVE-2014-4648

CVE-2014-4648 is a critical-severity vulnerability in Piwigo with a CVSS 2.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 2.0 base score 10.0)
EPSS exploit prediction: 1% (70th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Piwigo
Published: 2014-06-28
Last modified: 2026-06-17

Description

Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."

Frequently asked questions

What is CVE-2014-4648?: Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."
How severe is CVE-2014-4648?: CVE-2014-4648 has a CVSS 2.0 base score of 10.0, rated critical severity.
Is CVE-2014-4648 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (70th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-4648?: CVE-2014-4648 primarily affects Piwigo. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-4648?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2014-4648 published?: CVE-2014-4648 was published on 2014-06-28 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*
cpe:2.3:a:piwigo:piwigo:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:piwigo:piwigo:2.6.1:*:*:*:*:*:*:*

More vulnerabilities in Piwigo

CVE-2026-27634 — Critical (CVSS 9.8): Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter…
CVE-2023-33362 — Critical (CVSS 9.8): Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
CVE-2023-33361 — Critical (CVSS 9.8): Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
CVE-2020-19213 — Critical (CVSS 9.8): SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVE-2021-32615 — Critical (CVSS 9.8): Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVE-2017-10682 — Critical (CVSS 9.8): SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute…

All CVEs affecting Piwigo →