CVE-2012-0994

SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter...

CVE-2012-0995

CVE-2012-0995 affects Zenphoto 1.4.2 with multiple XSS vulnerabilities. The issue arises in ZENphoto where user-supplied input can be reflected in the browser via: (a) msg parameter to zp-core/admin.php, (b) PATH_INTO/PATH_INFO handling for unspecified URLs, (c) album parameter to zp-core/admin-e...

CVE-2012-0993

CVE-2012-0993 concerns Zenphoto 1.4.2. The vulnerability is an eval() code-injection in zp-core/zp-extensions/viewer_size_image.php, triggered when the viewer_size_image_saved cookie is not sanitized and the viewer_size_image plugin is enabled. An attacker can craft the cookie to execute arbitrar...

Multiple vulnerabilities in ZENphoto

Advisory ID: HTB23070 Product: ZENphoto Vendor: www.zenphoto.org Vulnerable Version: 1.4.2 and probably prior Tested Version: 1.4.2 Vendor Notification: 18 January 2012 Vendor Patch: 19 January 2012 Public Disclosure: 8 February 2012 Vulnerability Type: PHP Code Execution, SQL Injection, XSS...

Zenphoto Multiple Security Vulnerabilities

Zenphoto is prone to multiple cross-site scripting vulnerabilities, an SQL-injection vulnerability, and a PHP code-injection vulnerability. An attacker can exploit the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affecte...

Zenphoto <= 1.4.2 Multiple Vulnerabilities - Active Check

Zenphoto is prone to multiple cross-site scripting XSS vulnerabilities, an SQL injection SQLi vulnerability, and a PHP code injection vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

ZENphoto 1.4.2 Code Execution / XSS / SQL Injection

Advisory ID: HTB23070 Product: ZENphoto Vendor: www.zenphoto.org Vulnerable Version: 1.4.2 and probably prior Tested Version: 1.4.2 Vendor Notification: 18 January 2012 Vendor Patch: 19 January 2012 Public Disclosure: 8 February 2012 Vulnerability Type: PHP Code Execution, SQL Injection, XSS...

Multiple vulnerabilities in ZENphoto

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...

Zenphoto 1.4.1.4 Code Execution

?php / -------------------------------------------------------------------------- Zenphoto = 1.4.1.4 ajaxcreatefolder.php Remote Code Execution Exploit -------------------------------------------------------------------------- author............: Egidio Romano aka EgiX mail..............:...

ZenPhoto 1.4.1.4 - ajax_create_folder.php Remote Code Execution

ZenPhoto 1.4.1.4 - ajaxcreatefolder.php Remote Code Execution ?php / -------------------------------------------------------------------------- Zenphoto = 1.4.1.4 ajaxcreatefolder.php Remote Code Execution Exploit --------------------------------------------------------------------------...

ZenPhoto 1.4.1.4 - 'ajax_create_folder.php' Remote Code Execution

?php / -------------------------------------------------------------------------- Zenphoto = 1.4.1.4 ajaxcreatefolder.php Remote Code Execution Exploit -------------------------------------------------------------------------- author............: Egidio Romano aka EgiX mail..............:...

Zenphoto <= 1.4.1.4 (ajax_create_folder.php) Remote Code Execution

Exploit for php platform in category web applications ?php / -------------------------------------------------------------------------- Zenphoto = 1.4.1.4 ajaxcreatefolder.php Remote Code Execution Exploit --------------------------------------------------------------------------...

CVE-2010-4907

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2010-4906

SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2010-4906

SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-4907

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2010-4906

CVE-2010-4906 concerns SQL injection in Zenphoto before and including 1.3.1.2 via zp-core/full-image.php when processing the parameter a. Affected product: Zenphoto 1.3 and 1.3.1.2. Root cause: unsafely constructed SQL in the mentioned script enables remote attackers to execute arbitrary SQL comm...

CVE-2010-4907

Mode C: The CVE-2010-4907 entry describes a cross-site scripting (XSS) vulnerability in Zenphoto 1.3, affecting zp-core/admin.php where an attacker can inject arbitrary script via the user parameter. The vulnerability is noted to be related to the from parameter, which is already covered by CVE-2...