PT-2025-51954 · Zenphoto · Zenphoto

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-20 · CVE-2023-53916

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zenphoto version 1.6

Description The software contains a stored cross-site scripting issue in the user postal code field. This field is accessible through the 'admin-users.php' interface. When administrators view user information that includes HTML, malicious JavaScript payloads injected into the postal code field can execute in their browser. The vulnerable field is used when importing user information.

Recommendations Sanitize user input for the postal code field in the 'admin-users.php' interface to prevent the injection of malicious HTML or JavaScript code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-53916

Affected Products

Zenphoto

References · 6

• 🔥 https://vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-user-postal-code-field · Exploit
• 🔥 https://exploit-db.com/exploits/51485 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53916 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53916 · Vendor Advisory
• https://zenphoto.org/news/zenphoto-1.6 · Note
• https://twitter.com/CVEnew/status/2002487789460598978 · Twitter Post