Description (CNA)
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Zenphoto / Zenphoto | affected 1.6 |
CWE
CWE-79
References
- https://www.exploit-db.com/exploits/51485
- https://www.zenphoto.org/news/zenphoto-1.6/
- https://www.vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-user-postal-code-field
ADP enrichment
No English description supplied.