CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.
Explanation of Vulnerability in Simple Terms
Photo Gallery by 10Web versions up to 1.8.27 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts into gallery content. When other users view the gallery, the scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires user interaction—victims must view the affected gallery page.
What an attacker can do
Inject malicious scripts that execute when other users view the gallery, potentially stealing session data or performing actions on their behalf.
Potential impact on your site
Administrators can inject persistent malicious code into galleries that affects all visitors, compromising user sessions and data.
Conditions required to exploit
Attacker must have administrator-level access to the site and the victim must view the affected gallery page.
Key dates
External resources
Related vulnerabilities
