XSS in Zenphoto

CVE-2012-2641

Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.011 (63.6th percentile) — read the EPSS interpretation.

Affected products

Zenphoto — versions 0.9, 1.0, 1.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

vultures@jpcert.or.jp (x_refsource_CONFIRM)
vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)