CVE-2018-20140

CVE-2018-20140 affects ZenPhoto 1.4.14. The vulnerability is described as multiple cross-site scripting (XSS) flaws exploitable via different URL parameters (e.g., SEARCH_state, SEARCH_country, SEARCH_city). The issue is caused by improper handling of user input in these parameters, enabling inje...

Multiple Cross-Site Scripting Vulnerabilities in Zenphoto

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. Zenphoto suffers from multiple cross-site scripting vulnerabilities. A remote attacker can exploit this vulnerability to inject...

ZenPhoto 1.4.14 Cross Site Scripting

Multiple Cross-site Scripting Vulnerabilities in ZenPhoto 1.4.14 Information -------------------- Advisory by Netsparker Name: Multiple Cross-Site Scripting Vulnerabilities in ZenPhoto 1.4.14 Affected Software: ZenPhoto Affected Versions: 1.4.14 Homepage: http://www.zenphoto.org/ Vulnerability:...

Zenphoto local file inclusion vulnerability (CNVD-2018-16271)

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. A local file inclusion vulnerability exists in Zenphoto 1.4.14 and earlier versions. A remote attacker with administrative privileg...

CVE-2018-0610

Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information...

CVE-2018-0610

Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information...

Remote file inclusion

Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information...

CVE-2018-0610

CVE-2018-0610 is a Local File Inclusion in Zenphoto, affecting Zenphoto 1.4.14 and earlier. The root cause is LFI allowing a remote administrator to potentially execute arbitrary code or access sensitive information. Impact stated in multiple sources includes arbitrary code execution or exposure ...

CVE-2018-0610

Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information...

Local File Inclusion vulnerability in Zenphoto

Overview Zenphoto is a content management system CMS. Zenphoto contains a Local File Inclusion vulnerability. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Sensitive information may be obtained or...

Zenphoto Local File Containment Vulnerability

Zenphoto is a content management system CMS. A local file inclusion vulnerability exists in Zenphoto, which can be exploited by an attacker to obtain sensitive information or to execute arbitrary code by a remote administrative user...

JVN#33124193: Local File Inclusion vulnerability in Zenphoto

Zenphoto is a content management system CMS. Zenphoto contains a Local File Inclusion vulnerability. Impact Sensitive information may be obtained or arbitrary code may be executed by a remote administrative user. Solution Update the Software Update to the latest version according to the informati...

ZenPhoto 'sanitize_string' function cross-site scripting vulnerability

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. A cross-site scripting vulnerability exists in the 'sanitizestring' function in versions of ZenPhoto prior to 1.4.9. A remote...

CVE-2015-5594

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...

Cross site scripting

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...

CVE-2015-5594

ZenPhoto’s CVE-2015-5594 affects the sanitize_string function in ZenPhoto prior to version 1.4.9, where html_entity_decode is used after input sanitation, potentially enabling remote attackers to perform cross-site scripting via a crafted string. Affected software/version: ZenPhoto before 1.4.9. ...

CVE-2015-5594

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...

Zenphoto 1.4.11 - Remote File Inclusion

No description provided by source...

Zenphoto 1.4.11 Remote File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Zenphoto 1.4.11 Fixed in: 1.4.12 Fixed Version Link: https://github.com/zenphoto/zenphoto/archive/ zenphoto-1.4.12.zip Vendor Website: http://www.zenphoto.org/ Vulnerability Type: RFI Remote Exploitable: Yes Reported to...

ZenPhoto 1.4.11 - Remote File Inclusion

ZenPhoto 1.4.11 - Remote File Inclusion Security Advisory - Curesec Research Team 1. Introduction Affected Product: Zenphoto 1.4.11 Fixed in: 1.4.12 Fixed Version Link: https://github.com/zenphoto/zenphoto/archive/ zenphoto-1.4.12.zip Vendor Website: http://www.zenphoto.org/ Vulnerability Type: R...