CVE-2023-53916 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administ… |
CVE-2023-53915 | Medium | 4.6 | 2025-12-17 | Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content int… |
CVE-2022-44449 | Medium | 4.8 | 2022-12-21 | Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to i… |
CVE-2020-36079 | High | 7.2 | 2021-02-26 | Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin… |
CVE-2020-5593 | High | 8.8 | 2020-06-11 | Zenphoto versions prior to 1.5.7 allows an attacker to conduct PHP code injection attacks by leading a user to upload a specially crafted .zip file. |
CVE-2020-5592 | Medium | 6.1 | 2020-06-11 | Cross-site scripting vulnerability in Zenphoto versions prior to 1.5.7 allows remote attackers to inject an arbitrary JavaScript via unspecified vectors. |
CVE-2012-4519 | Medium | 6.1 | 2020-02-11 | Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS. |
CVE-2015-5595 | Medium | 6.5 | 2019-12-31 | Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for r… |
CVE-2015-5593 | Medium | 6.1 | 2019-12-31 | The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XS… |
CVE-2015-5592 | Medium | 6.1 | 2019-12-31 | Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks. |
CVE-2015-5591 | High | 7.2 | 2019-12-31 | SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands. |
CVE-2018-20140 | Medium | 6.1 | 2019-03-21 | Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters. |
CVE-2018-0610 | High | 7.2 | 2018-06-26 | Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain… |
CVE-2015-5594 | Medium | 6.1 | 2017-07-25 | The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to pe… |
CVE-2015-2949 | | | 2015-05-31 | Cross-site scripting (XSS) vulnerability in ZenPhoto20 1.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2015-2948 | | | 2015-05-31 | Cross-site scripting (XSS) vulnerability in the image processor in Zenphoto before 1.4.8 allows remote attackers to inject arbitrary web script or HTML via uns… |
CVE-2013-7242 | | | 2013-12-31 | SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbi… |
CVE-2013-7241 | | | 2013-12-31 | Cross-site scripting (XSS) vulnerability in the export function in zp-core/zp-extensions/mergedRSS.php in Zenphoto before 1.4.5.4 allows remote attackers to in… |
CVE-2012-2641 | | | 2012-07-05 | Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interac… |
CVE-2012-0995 | | | 2012-02-21 | Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter i… |
CVE-2012-0994 | | | 2012-02-21 | SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrar… |
CVE-2012-0993 | | | 2012-02-21 | Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote atta… |
CVE-2010-4907 | | | 2011-10-08 | Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.3 allows remote attackers to inject arbitrary web script or HTML via the user param… |
CVE-2010-4906 | | | 2011-10-08 | SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter… |
CVE-2009-4566 | | | 2010-01-04 | SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action… |
CVE-2009-4564 | | | 2010-01-04 | SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via t… |
CVE-2009-4563 | | | 2010-01-04 | Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administ… |
CVE-2009-4562 | | | 2010-01-04 | Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from par… |
CVE-2008-6925 | | | 2009-08-10 | Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vecto… |
CVE-2007-6666 | | | 2008-01-04 | SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter. |
CVE-2007-0616 | | | 2007-01-31 | Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary directories via ".." se… |
CVE-2006-2187 | | | 2006-05-04 | Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1… |
CVE-2006-2186 | | | 2006-05-04 | zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos… |