EUVD-2012-1018

Malware in sbrugna...

CVE-2012-0995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 msg parameter in an external action to zp-core/admin.php, 2 PATHINTO to an unspecified URL, as demonstrated using /1/, 3 PATHINFO to zp-core/admin.php, or 4...

CVE-2010-4907: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user parameter. NOTE: the from parameter is already covered by CVE-2009-4562...

CVE-2009-4562: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter...