Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-96673

Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Photoview
Products
Photoview
CVE-2026-96271

Photoview through 2.4.0 Authorization Bypass via shareAlbum

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Photoview
Products
Photoview