CVE-2009-4564 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 0.8% (pctl 57)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 0.85% — more likely to be exploited than 57% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-01-04 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| zenphoto | zenphoto |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ZenPhoto 1.2.5 - Completely Blind SQL Injection | 2009-07-15 |
→ the Explorer · watch your stack · NVD