CVE-2015-9102: Synology Photo Station

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

Affected products

• Synology Photo Station: up to and including 6.3-2960

Published 2017-06-30. Last modified 2026-06-17.