VULNERABILITY INTELLIGENCE

CVE-2023-53916

CVSS score5.4 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2025-12-17

Last modified2026-06-17

Description

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.