CVE-2006-2187: Zenphoto

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in zenphoto 1.0.1 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) a parameter in i.php, and the (2) album and (3) image parameters in index.php.

Affected products

• Zenphoto Zenphoto: up to and including 1.0.1_beta; version 0.9 only; version 1.0_beta only

Published 2006-05-04. Last modified 2026-06-16.