CVE-2015-5594 The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to perform a cross-site scripting (XSS) via a....
MediumCVSS 6.1
EPSS 1.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to perform a cross-site scripting (XSS) via a crafted string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zenphoto | <= 1.4.8 | No fix listed |
References
- cve.killedkenny.io not-applicable
- [oss-security] 20150718 Re: CVE request: Zenphoto before 1.4.9 multiple vulnerabilities exploit mailing-list third-party-advisory
- www.zenphoto.org release-notes third-party-advisory
- software-talk.org exploit third-party-advisory