How severe is CVE-2025-62512?

CVE-2025-62512 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-62512 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-62512?

CVE-2025-62512 affects Piwigo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-62512?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-62512 have an EU (EUVD) identifier?

Yes. CVE-2025-62512 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208096.

When was CVE-2025-62512 published?

CVE-2025-62512 was published on 2026-02-24 and last updated on 2026-06-17.

CVE-2025-62512

CVE-2025-62512 is a medium-severity vulnerability in Piwigo with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-204.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 5.5
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-208096
Weakness: CWE-204
Affected product: Piwigo
Published: 2026-02-24
Last modified: 2026-06-17

Description

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

Frequently asked questions

What is CVE-2025-62512?: Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
How severe is CVE-2025-62512?: CVE-2025-62512 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-62512 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-62512?: CVE-2025-62512 affects Piwigo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-62512?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-62512 have an EU (EUVD) identifier?: Yes. CVE-2025-62512 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208096.
When was CVE-2025-62512 published?: CVE-2025-62512 was published on 2026-02-24 and last updated on 2026-06-17.

References

https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc

Affected products (1)

cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*

More vulnerabilities in Piwigo

CVE-2014-4648 — Critical (CVSS 10.0): Unspecified vulnerability in Piwigo before 2.6.3 has unknown impact and attack vectors, related to a "security failure."
CVE-2026-27634 — Critical (CVSS 9.8): Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter…
CVE-2023-33362 — Critical (CVSS 9.8): Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
CVE-2023-33361 — Critical (CVSS 9.8): Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.
CVE-2020-19213 — Critical (CVSS 9.8): SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
CVE-2021-32615 — Critical (CVSS 9.8): Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.

All CVEs affecting Piwigo →

Other CWE-204 vulnerabilities

CVE-2018-25350 — Critical (CVSS 9.8): userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid…
CVE-2025-5485 — High (CVSS 8.6): User names used to access the web management interface are limited to the device identifier, which is a numerical…
CVE-2026-33419 — High (CVSS 7.5): MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security…
CVE-2025-12455 — High (CVSS 7.5): Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing. The…
CVE-2025-46390 — High (CVSS 7.5): CWE-204: Observable Response Discrepancy
CVE-2025-3092 — High (CVSS 7.5): An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.

Browse all CWE-204 vulnerabilities →