330 matches found
ZenPhoto SQL Injection Vulnerability (CNVD-2020-03274)
ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A SQL injection vulnerability exists in Zenphoto versions prior to 1.4.9. The vulnerability stems from a database-based application that lacks validation of...
CVE-2015-5593
The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "scriptpayload", or in an image tag, with the payload as the onerror event...
CVE-2015-5595
Cross-site request forgery CSRF vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service resource consumption...
CVE-2015-5591
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands...
CVE-2015-5592
Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...
Cross site scripting
Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service resource consumption...
Sql injection
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands...
Cross site scripting
The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "scriptpayload", or in an image tag, with the payload as the onerror event...
CVE-2015-5595
Cross-site request forgery CSRF vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service resource consumption...
CVE-2015-5595
Zenphoto is affected by a CSRF in admin.php prior to version 1.4.9 that could allow an attacker to hijack an admin’s session and trigger requests leading to resource consumption (denial of service). Public sources confirm the vulnerability exists in Zenphoto
CVE-2015-5593
The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "scriptpayload", or in an image tag, with the payload as the onerror event...
CVE-2015-5593
Zenphoto contains a XSS flaw in the sanitize_string function present in versions prior to 1.4.9. Attackers can trigger client-side script execution by injecting payloads into HTML or image tag onerror handlers. The issue is documented across CVE-2015-5593 entries and linked CNVD/CVE records. Reme...
CVE-2015-5592
Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...
CVE-2015-5592
Zenphoto is affected by CVE-2015-5592 due to an incomplete blacklist in sanitize_string prior to version 1.4.9, enabling remote attackers to conduct cross-site scripting (XSS). The vulnerability affects Zenphoto 1.4.x before 1.4.9. The root cause is improper input validation in the sanitize_strin...
CVE-2015-5591
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands...
CVE-2015-5591
ZenPhoto is affected by an SQL injection vulnerability in versions prior to 1.4.9. The issue arises because user input is not adequately validated, allowing a remote attacker with administrative access to inject and execute arbitrary SQL commands. Impact is the potential compromise of data confid...
ZenPhoto cross-site scripting vulnerability (CNVD-2020-03822)
ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A cross-site scripting vulnerability exists in the 'sanitizestring' function in versions of Zenphoto prior to 1.4.9, which stems from a lack of proper...
