VULNERABILITY INTELLIGENCE

CVE-2023-53939

CVSS score5.4 MEDIUM

EPSS probability0.24%

CISA KEVNot currently listed

Published2025-12-18

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.

Weakness classification

disclosure@vulncheck.com: CWE-79

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory, VDB Entry