$ cve CVE-2005-0928 JSON

CVE-2005-0928 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4% (pctl 90)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the (1) cat, (2) password, (3) ppuser, (4) sort, or (5) si parameters to showgallery.php, the (6) ppuser, (7) sort, or (8) si parameters to showmembers.php, or (9) the photo parameter to slideshow.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	3.99% — more likely to be exploited than 90% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-05-02
Last modified	2026-06-16

Affected (1)

Vendor	Product
photopost	photopost php pro

Public exploits

Source	Title	Date
exploit-db	PhotoPost Pro 5.1 - 'showgallery.php' Multiple Cross-Site Scripting Vulnerabilities	2005-03-28
exploit-db	PhotoPost Pro 5.1 - 'showmembers.php' Multiple Cross-Site Scripting Vulnerabilities	2005-03-28
exploit-db	PhotoPost Pro 5.1 - 'Slideshow.php?photo' Cross-Site Scripting	2005-03-28

References

→ the Explorer · watch your stack · NVD