Description
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zenphoto | Zenphoto | 1.6 | — |
References
- ExploitDB-51485 exploit
- Official Product Webpage product
- VulnCheck Advisory: Zenphoto 1.6 Stored Cross-Site Scripting via User Postal Code Field third-party-advisory