CVE-2022-44449

Zenphoto is affected by a stored cross-site scripting vulnerability (CVE-2022-44449) in versions prior to 1.6. The issue allows a remote authenticated attacker with administrative privileges to inject arbitrary scripts, impacting users who view vulnerable pages. The root cause as described is sto...

CVE-2022-44449

Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script...

CVE-2022-44449

Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script...

CVE-2022-44449

Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script...

Zenphoto vulnerable to cross-site scripting

Overview Zenphoto contains a stored cross-site scripting vulnerability CWE-79. Terada Yu of Fujitsu System Integration Laboratories reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be...

JVN#06093462: Zenphoto vulnerable to cross-site scripting

Zenphoto contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is using the product. Solution Update the software Update the software to the latest version according to the information provided by the developer...

ZenPhoto 跨站脚本漏洞

ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A security vulnerability exists in versions of ZenPhoto prior to 1.6, which can be exploited by an attacker to execute arbitrary scripts on the web browser ...

Zenphoto Arbitrary File Upload Vulnerability

Zenphoto is an open source content management system CMS for building multimedia websites. An arbitrary file upload vulnerability exists in Zenphoto 1.5.7 and earlier versions. An attacker can exploit this vulnerability by navigating to the uploader plugin, checking the elFinder box, and then...

CVE-2020-36079

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the FileselFinder portion of the UI. This can, for example, place a .php file i...

CVE-2020-36079

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the FileselFinder portion of the UI. This can, for example, place a .php file i...

Design/Logic Flaw

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the FileselFinder portion of the UI. This can, for example, place a .php file i...

CVE-2020-36079

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the FileselFinder portion of the UI. This can, for example, place a .php file i...

CVE-2020-36079

Zenphoto CMS

CVE-2020-36079

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the FileselFinder portion of the UI. This can, for example, place a .php file i...

Zenphoto 代码问题漏洞

Zenphoto is an open source content management system CMS for building multimedia websites. An arbitrary file upload vulnerability exists in Zenphoto 1.5.7 and earlier versions. An attacker can exploit this vulnerability by navigating to the uploader plugin, checking the elFinder box, and then...

Zenphoto CMS 1.5.7 Shell Upload

Authenticated arbitrary file upload to RCE Product : Zenphoto Affected : Zenphoto CMS - = 1.5.7 Attack Type : Remote login then go to plugins then go to uploader and press on the check box elFinder then press apply , after that you go to upload then FileselFinder drag and drop any malicious php...

Zenphoto CMS 1.5.7 Shell Upload Vulnerability

Authenticated arbitrary file upload to RCE Product : Zenphoto Affected : Zenphoto CMS - = 1.5.7 Attack Type : Remote login then go to plugins then go to uploader and press on the check box elFinder then press apply , after that you go to upload then FileselFinder drag and drop any malicious php...

PT-2021-11913 · Zenphoto · Zenphoto

Name of the Vulnerable Software and Affected Versions: Zenphoto versions 1.5.7 and earlier Description: The issue allows for authenticated arbitrary file upload, leading to remote code execution. An attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop file...

Multiple vulnerabilities in Zenphoto

Overview Zenphoto is a content management system CMS. Zenphoto contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5592 Code Injection CWE-94 - CVE-2020-5593 Tomohisa Maeda of Panasonic Corporation, Product Security Center reported this vulnerability to IPA...

CVE-2020-5593

Zenphoto versions prior to 1.5.7 allows an attacker to conduct PHP code injection attacks by leading a user to upload a specially crafted .zip file...