Is CVE-2026-96673 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96673?

CVE-2026-96673 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-96673

Description

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.