Vulnerabilities > Zenphoto

DATE CVE VULNERABILITY TITLE RISK
2011-10-08 CVE-2010-4906 SQL Injection vulnerability in Zenphoto 1.3/1.3.1.2
SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter.
network
low complexity
zenphoto CWE-89
7.5
2010-01-04 CVE-2009-4566 SQL Injection vulnerability in Zenphoto 1.2.5
SQL injection vulnerability in index.php in Zenphoto 1.2.5 allows remote attackers to execute arbitrary SQL commands via the title parameter in a news action.
network
low complexity
zenphoto CWE-89
7.5
2010-01-04 CVE-2009-4564 SQL Injection vulnerability in Zenphoto 1.2.5
SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.
network
zenphoto CWE-89
6.8
2010-01-04 CVE-2009-4563 Cross-Site Scripting vulnerability in Zenphoto 1.2.5
Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action.
network
zenphoto CWE-79
4.3
2010-01-04 CVE-2009-4562 Cross-Site Scripting vulnerability in Zenphoto 1.2.5
Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the from parameter.
network
zenphoto CWE-79
4.3
2009-08-10 CVE-2008-6925 Cross-Site Scripting vulnerability in Zenphoto 1.1.7
Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature.
network
zenphoto CWE-79
4.3
2008-01-04 CVE-2007-6666 SQL Injection vulnerability in Zenphoto
SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the albumnr parameter.
network
low complexity
zenphoto CWE-89
7.5
2007-01-31 CVE-2007-0616 Unspecified vulnerability in Zenphoto 1.0.4/1.0.5/1.0.6
Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary directories via ".." sequences in the album parameter to index.php.
network
low complexity
zenphoto
7.8
2006-05-04 CVE-2006-2187 Cross-Site Scripting vulnerability in Zenphoto
Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php.
network
zenphoto
6.8
2006-05-04 CVE-2006-2186 Cross-Site Scripting vulnerability in Zenphoto 0.9/1.0.1Beta/1.0Beta
zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.
network
low complexity
zenphoto
5.0