Description
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.
Remediation
References
Related Vulnerabilities
Joomla CVE-2019-15028 Vulnerability (CVE-2019-15028)
IBM RTC Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-0748)
Jenkins Improper Input Validation Vulnerability (CVE-2021-21606)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-0762)
Apache Traffic Server Improper Input Validation Vulnerability (CVE-2026-58183)