CVE-2026-96673 — Photoview through 2.4.0 SQL Injection via album download route
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path…
Published: 2026-09-23 · CVSS: 8.7 · CVSS 4.0
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7