CVE-2015-4656

Synology Photo Station prior to version 6.3-2945 contains XSS vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via (1) the success parameter to login.php or (2) crafted URL parameters to index.php, demonstrated by the t parameter to photo/. The CVE-2015-46...