Vulnerabilities > Zenphoto
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-01-04 | CVE-2009-4564 | SQL Injection vulnerability in Zenphoto 1.2.5 SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/. | 6.8 |
| 2010-01-04 | CVE-2009-4563 | Cross-Site Scripting vulnerability in Zenphoto 1.2.5 Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action. | 4.3 |
| 2010-01-04 | CVE-2009-4562 | Cross-Site Scripting vulnerability in Zenphoto 1.2.5 Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter. | 4.3 |
| 2009-08-10 | CVE-2008-6925 | Cross-Site Scripting vulnerability in Zenphoto 1.1.7 Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature. | 4.3 |
| 2008-01-04 | CVE-2007-6666 | SQL Injection vulnerability in Zenphoto SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter. | 7.5 |
| 2007-01-31 | CVE-2007-0616 | Unspecified vulnerability in Zenphoto 1.0.4/1.0.5/1.0.6 Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary directories via ".." sequences in the album parameter to index.php. | 7.8 |
| 2006-05-04 | CVE-2006-2187 | Cross-Site Scripting vulnerability in Zenphoto Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php. network zenphoto | 6.8 |
| 2006-05-04 | CVE-2006-2186 | Cross-Site Scripting vulnerability in Zenphoto 0.9/1.0.1Beta/1.0Beta zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message. | 5.0 |