CVE-2021-27973
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
Affects 1 product across 1 vendor.
Attacker inserts SQL commands into application queries through user-controlled input, allowing unauthorized database access.
Show all 6
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A SQL injection vulnerability exists in Piwigo versions prior to 11.4.0, allowing an attacker to manipulate the 'language' parameter in the admin.php page. This can lead to unauthorized access and data manipulation, posing a significant risk to the integrity and availability of the system.
BSID: BS-2021-GLOBAL-268666-H • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-27973?
What is the CVSS score for CVE-2021-27973?
Is CVE-2021-27973 actively exploited?
How do I remediate CVE-2021-27973?
What systems are affected by CVE-2021-27973?
What NERC-CIP standard applies to CVE-2021-27973?
What IEC 62443 requirement maps to CVE-2021-27973?
| CVE ID | CVE-2021-27973 |
|---|---|
| BSID | BS-2021-GLOBAL-268666-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-04-02 |
| Last Modified | 2024-11-21 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited by an authenticated user with administrative privileges. The attacker can inject malicious SQL code through the 'language' parameter in the admin.php?page=languages URL, potentially leading to data exfiltration, data manipulation, or system compromise.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Piwigo | Piwigo | < 11.4.0 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement input validation and sanitization for the 'language' parameter in the admin.php page. Use prepared statements or parameterized queries to prevent SQL injection.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to the system, which can compromise the security of the control system and its data.
This CVE maps to SR 7.6 as it involves a vulnerability that can be exploited to manipulate the system, leading to potential data loss or system compromise, which is a critical security concern in ICS environments.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 910b9211da78019acaafeb494e2718c53eb51b77422efe1430e71968c973d3acba2af37deba73621c37967c2bf8fba186f404737f1b8219f660c7db9460bb36f |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →