CVE-2025-62512 - Vulnerability Analysis

Overview

Piwigo 15.5.0 and earlier 15.x versions contain a user enumeration vulnerability caused by distinct messages in password reset functionality at password.php?action=lost, letting unauthenticated attackers determine valid usernames or emails, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can enumerate valid usernames or email addresses, aiding further targeted attacks.

Mitigation

Update to the latest version when available or apply mitigations to unify response messages.

References

• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-h4wx-7m83-xfxc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner