CVE-2025-62512

The record

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

Affected packages

Related vulnerabilities

• CVE-2026-89173 Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive… CWE-204
• CVE-2026-9161 Observable response discrepancy vulnerability in DernekPlus Website Template allows… CWE-204
• CVE-2026-19205 Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows… CWE-204
• CVE-2026-19080 Observable response discrepancy vulnerability in Menulux Software Inc. CWE-204
• CVE-2026-78584 Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to… CWE-204
• CVE-2026-84307 Filament is a collection of full-stack components for accelerated Laravel development. CWE-204
• CVE-2026-66002 Frappe is a full-stack web application framework. CWE-204
• CVE-2026-54739 Lemmy is a link aggregator and forum for the fediverse. CWE-204