CVE-2025-62512
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
| CWE | CWE-204 |
| Vendor | piwigo |
| Product | piwigo |
| Published | Feb 24, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for piwigo piwigo
Be the first to know when new unknown vulnerabilities affecting piwigo piwigo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Piwigo / Piwigo
= 15.5.0