CVE-2023-53915

5.1 mediumEPSS 0.3%

Medium (5.1) in zenphoto zenphoto. EPSS 0.3% chance of exploitation in the next 30 days.

Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting HTML content into album descriptions. Attackers can create albums with malicious iframe or script tags in the description field that execute when users view the album page.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

4.6 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zenphoto:zenphoto

References

https://www.exploit-db.com/exploits/51485
https://www.vulncheck.com/advisories/zenphoto-stored-cross-site-scripting-via-album-description
https://www.zenphoto.org/news/zenphoto-1.6/
https://www.exploit-db.com/exploits/51485

Check your stack JSON