Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
on `file` param. No worry with an admin, but this method can be used by a community user as well.

Originally reported by Zak S. see CVE-2020-9467
stored XSS with pwg.images.setInfo
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : stored XSS with pwg.images.setInfo
Issue date:

--- start body ---
on `file` param. No worry with an admin, but this method can be used by a community user as well.

Originally reported by Zak S. see CVE-2020-9467
--- end body ---
