CVE-2010-4907

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

Cross site scripting

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2010-4907

Mode C: The CVE-2010-4907 entry describes a cross-site scripting (XSS) vulnerability in Zenphoto 1.3, affecting zp-core/admin.php where an attacker can inject arbitrary script via the user parameter. The vulnerability is noted to be related to the from parameter, which is already covered by CVE-2...

CVE-2010-4906

CVE-2010-4906 concerns SQL injection in Zenphoto before and including 1.3.1.2 via zp-core/full-image.php when processing the parameter a. Affected product: Zenphoto 1.3 and 1.3.1.2. Root cause: unsafely constructed SQL in the mentioned script enables remote attackers to execute arbitrary SQL comm...