CVE-2012-5891: Dalbum

Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.

Affected products

• Dalbum Dalbum: up to and including 1.44; version 1.03 only; version 1.3 only; version 1.04 only; version 1.05 only; version 1.06 only; …

Published 2012-11-17. Last modified 2026-06-16.