PT-2025-51953 · Zenphoto · Zenphoto

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-24 · CVE-2023-53915

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zenphoto version 1.6

Description An authenticated attacker can inject malicious scripts by inserting HTML content into album descriptions. Attackers can create albums with malicious iframe or script tags in the description field, which execute when users view the album page. The issue is a stored cross-site scripting condition.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all HTML content entered into the album description field to remove potentially malicious script or iframe tags.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-53915

Affected Products

Zenphoto

References · 7

• 🔥 https://vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-album-description · Exploit
• 🔥 https://exploit-db.com/exploits/51485 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53915 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53915 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002487790337204471 · Twitter Post
• https://t.me/cveNotify/146797 · Telegram Post
• https://zenphoto.org/news/zenphoto-1.6 · Note