CVE-2016-4337: Ktools Photostore

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to execute arbitrary SQL commands via the email parameter in a recover_login action.

Affected products

• Ktools Photostore: up to and including 4.7.4

Published 2017-04-12. Last modified 2026-06-17.