CVE-2024-46606 is a cross-site scripting (XSS) vulnerability affecting Piwigo version 14.5.0. The vulnerability exists in the /admin.php?page=photo component, where an attacker can inject crafted payloads into the Description field. This injection allows execution of arbitrary web scripts or HTML, which can lead to partial compromise of confidentiality and integrity. The vulnerability requires network access, low attack complexity, and limited privileges with user interaction. No known exploits in the wild or vendor patches have been reported at this time.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure or manipulation of data within the application. There is no impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component to trusted users only and consider applying input validation or sanitization controls if possible.