CVE-2025-62512 - CVE House
Back to Database
Status published Medium CVE-2025-62512

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

Vulnerability Description

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62512

Credits & Attribution

No credits recorded in the NVD database.

References

More from Piwigo

View All →
CVE-2025-62406
Piwigo is vulnerable to one-click account takeover by modifying the password-reset link
High 8.1
CVE-2024-48928
Piwigo's secret key can be brute forced
Low 2.7
CVE-2023-44393
Piwigo Reflected XSS vulnerability
Critical 9.3
CVE-2023-37270
Piwigo SQL Injection vulnerability in "User-Agent"
High 7.6

Affected Vendor

Affected Software

Piwigo
Vulnerable Versions:
= 15.5.0

Timeline

Official Publish: February 24th, 2026
Last Modified: February 27th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-204

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.