Description

Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.

Remediation

References

CVE-2015-5592

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-3439)

Internet Information Services Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-1999-0874)

WordPress Plugin WP-Lister Lite for Amazon Cross-Site Scripting (2.4.3)

WordPress Plugin copy-me Cross-Site Request Forgery (1.0.0)

WordPress Plugin Simple Image Gallery Cross-Site Scripting (1.0.6)

Severity

Medium

Classification

CVE-2015-5592 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities