CVE-2015-5593: Zenphoto

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "<<script></script>script>payload<script></script></script>", or in an image tag, with the payload as the onerror event.

Affected products

• Zenphoto Zenphoto: before 1.4.9 (fixed in 1.4.9)

Published 2019-12-31. Last modified 2026-06-17.