Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Zenphoto Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2012-0995 - Vulnerability Database
Zenphoto

Zenphoto Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2012-0995

Medium
Reference: CVE-2012-0995
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2012-0995
Title: Zenphoto Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php (2) PATH_INTO to an unspecified URL as demonstrated using /1/ (3) PATH_INFO to zp-core/admin.php or (4) album parameter to zp-core/admin-edit.php.