EUVD-2012-1018

Malware in sbrugna...

PT-2012-3000

Name of the Vulnerable Software and Affected Versions ZENphoto version 1.4.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the msg parameter in an external action to "zp-core/admin.php", PATH INFO to "zp-core/admin.php", or the albu...

CVE-2012-0995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...

CVE-2010-4907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2009-4562: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter...