← Volver a CVEs

CVE-2023-53916

MEDIUM

4.6

Descripcion

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.

Detalles CVE

Puntuacion CVSS v3.14.6

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado12/17/2025

Ultima modificacion12/27/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

zenphoto:zenphoto

Debilidades (CWE)

CWE-79

Referencias

https://www.exploit-db.com/exploits/51485(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-user-postal-code-field(disclosure@vulncheck.com)

https://www.zenphoto.org/news/zenphoto-1.6/(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/51485(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.