2Mzrp

**Name of the Vulnerable Software and Affected Versions** phpAlbum versions 0.4.1.16 and earlier **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `var1` and `keyword` parameters in the main.php file. **Recommendations** For phpAlbum versions 0.4.1.16 and earlier, avoid using the `var1` and `keyword` parameters in the main.php file until a fix is available. As a temporary workaround, consider restricting access to the main.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** phpAlbum versions 0.4.1.16 and earlier **Description** The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the main.php file. This is achieved by using a .. (dot dot) in the `var1` parameter. **Recommendations** For phpAlbum versions 0.4.1.16 and earlier, consider restricting access to the main.php file or the `var1` parameter to minimize the risk of exploitation until a patch is available.