CVE-2015-9102 - AskarLabs CVE Database

CVE-2015-9102

Vendor Synology

Product Photo Station

Weakness CWE-79 · XSS

Published June 30, 2017

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

Key dates

02Disclosure timeline

June 30, 2017 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2015-9102 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2021-24545 WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting CVE-2022-1906 Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting CVE-2024-11893 Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2022-47435 WordPress WP-OliveCart Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) CVE-2015-10117 Gravity Forms DPS PxPay Plugin cross site scripting

Identifiers

CVE CVE-2015-9102

CWE CWE-79

Affected versions

Vendor Synology

Product Photo Station

Affected 6.0

Vendor Synology

Product Photo Station

Affected 6.3