EUVD-2015-5547

Malware in sbrugna...

CVE-2015-5593

The sanitizestring function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting XSS attack by wrapping a payload in "scriptpayload", or in an image tag, with the payload as the onerror event...

CVE-2015-5592

Zenphoto is affected by CVE-2015-5592 due to an incomplete blacklist in sanitize_string prior to version 1.4.9, enabling remote attackers to conduct cross-site scripting (XSS). The vulnerability affects Zenphoto 1.4.x before 1.4.9. The root cause is improper input validation in the sanitize_strin...

CVE-2015-5594

The sanitizestring function in ZenPhoto before 1.4.9 utilized the htmlentitydecode function after input sanitation, which might allow remote attackers to perform a cross-site scripting XSS via a crafted string...