Zenphoto vulnerable to cross-site scripting

Overview Zenphoto is a content management system CMS. Zenphoto contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing encoded user-supplied input. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

JVN#68452022: Zenphoto vulnerable to cross-site scripting

Zenphoto is a content management system CMS. Zenphoto contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing encoded user-supplied input. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version...

zenphoto -- multiple vulnerabilities

zenphoto reports: Fixes several SQL Injection, XSS and path traversal security issues...

WordPress Zenphoto Plugin <= 1.4.5.2 - SQL Injection

This plugin is prone to a wordpressimport.php wpprefix function SQL injection vulnerability. Solution Update the plugin...

Zenphoto 1.4.5.2 - wordpress_import.php wp_prefix Function SQL Injection

The zenphoto WordPress plugin was affected by a wordpressimport.php wpprefix Function SQL Injection security vulnerability...

Zenphoto - Config Update and Command Execute Vulnerability

No description provided by source. ?php / | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-26-zenphoto-config-update-and-command-execute-vulnerability/ Abysssec Inc Public Advisory Title :...

zenphoto 0.9/1.0 i.php a Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17779/info Zenphoto is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

Zenphoto CMS 1.3 - Multiple CSRF Vulnerabilities

No description provided by source. !--- Title: Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities Author: 10n1z3d 10n1z3datwdotcn Date: Wed 14 Jul 2010 12:48:56 PM EEST Vendor: http://www.zenphoto.org/ Download: http://zenphoto.googlecode.com/files/zenphoto-1.3.tar.gz --- -= CSRF PoC 1 - Change Admin...

zenphoto 0.9/1.0 index.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17779/info Zenphoto is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...

ZenPhoto 1.4.0.3 x-forwarded-for HTTP Header presisitent XSS

No description provided by source. Exploit Title: ZenPhoto 1.4.0.3 patched 2011-4-19 x-forwarded-for HTTP Header presisitent XSS Date: 21-4-2011 Author: Saif El-Sherei Software Link: http://zenphoto.googlecode.com/files/zenphoto-1.4.0.3.zip Version: 1.4.0.3 latest updated 2011-4-19 Tested on:FF...

zenphoto 1.4.3.3 - Multiple Vulnerabilities

No description provided by source. waraxe-2012-SA096 - Multiple Vulnerabilities in Zenphoto 1.4.3.3 =============================================================================== Author: Janek Vind waraxe Date: 03. November 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-96.html...

Zenphoto <= 1.4.1.4 (ajax_create_folder.php) Remote Code Execution

No description provided by source. ?php / -------------------------------------------------------------------------- Zenphoto = 1.4.1.4 ajaxcreatefolder.php Remote Code Execution Exploit -------------------------------------------------------------------------- author............: Egidio Romano a...

ZenPhoto - SQL Injection

ZenPhoto - SQL Injection source: https://www.securityfocus.com/bid/65126/info ZenPhoto is prone to an SQL-injection vulnerability and multiple path-disclosure vulnerabilities. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent...

ZenPhoto 1.4.4 Path Disclosure / SQL Injection

----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz ----------------------------------------- ---------------------------- K |................| . h |.......................| A a |.......................| N l |.....................| S E |.......................| e D...

ZenPhoto - SQL Injection

source: https://www.securityfocus.com/bid/65126/info ZenPhoto is prone to an SQL-injection vulnerability and multiple path-disclosure vulnerabilities. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlyi...

ZenPhoto v1.4.4 (SQLi/Disclosure) Multiple Vulnerabilities

ZenPhoto version 1.4.4 is suffer from multiple vulnerabilities remote attacker can use some MySQL bug in &date= and exploit it as SQL Injection ,and access to some files and get errors with the Full Path of this files and use it to disclosure the target full path...

Zenphoto SQL注入漏洞

CVE ID:CVE-2013-7242 Zenphoto是Zenphoto团队开发的一套免费的图片库内容管理系统。该系统可管理图片，且支持音频、视频等多媒体。 Zenphoto zp-core/zp-extensions/wordpressimport.php脚本中存在SQL注入漏洞。远程攻击者可借助特制的‘tableprefix’参数利用该漏洞执行任意SQL命令。 0 Zenphoto = 1.4.5.3 厂商补丁： Zenphoto ----- 厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：...

CVE-2013-7241

Cross-site scripting XSS vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2013-7242

SQL injection vulnerability in zp-core/zp-extensions/wordpressimport.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to inject arbitrary web script or HTML via the URI...