CVE-2012-4926: Imgpals Img Pals Photo Host

Medium severity, CVSS 6.4. EPSS: 1.9% chance of exploitation in the next 30 days.

approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.

Affected products

• Imgpals Img Pals Photo Host: version 1.0 only

Published 2012-09-15. Last modified 2026-06-16.