CVE-2023-53916 — Zenphoto 1.6 Stored Cross-Site Scripting via User Postal Code Field
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user i…
Published: 2025-12-17 · CVSS: 5.1 · CVSS 4.0
Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7