PatchTheCVEfacetag vulnerabilities and fixes
Recent CVEs affecting facetag, with upgrade or downgrade steps. 2 tracked.
facetag has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-02-26. Highest priority: CVE-2017-9426 (score 66/100).
- CVE-2017-9426 CRITICAL 9.8 DOWNGRADE ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.c
- CVE-2017-9425 MEDIUM 6.1 DOWNGRADE The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag acti
FAQ
How do I fix facetag vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is facetag being exploited right now?
None of the tracked facetag CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which facetag CVE should I patch first?
CVE-2017-9426 currently ranks highest (66/100): ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.c.