CVE-2015-5594

Опубликовано: 25 июл. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to perform a cross-site scripting (XSS) via a crafted string.

Ссылки

http://cve.killedkenny.io/cve/CVE-2015-5594
Not Applicable
http://www.openwall.com/lists/oss-security/2015/07/18/3
Exploit
Mailing List
Third Party Advisory
http://www.zenphoto.org/news/zenphoto-1.4.9
Release Notes
Third Party Advisory
https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
Exploit
Third Party Advisory
http://cve.killedkenny.io/cve/CVE-2015-5594
Not Applicable
http://www.openwall.com/lists/oss-security/2015/07/18/3
Exploit
Mailing List
Third Party Advisory
http://www.zenphoto.org/news/zenphoto-1.4.9
Release Notes
Third Party Advisory
https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zenphoto:zenphoto:*:*:*:*:*:*:*:*

Версия до 1.4.8 (включая)

EPSS

Процентиль: 52%

0.00292

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-7wgh-v5p6-rhqh