PT-2026-145034

CVE-2026-123667

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Photo Engine (Media Organizer & Lightroom) versions prior to 6.6.2

Description Insufficient sanitization and escaping of keyword names before they are stored and displayed on the debugging page allow users with the Author role and above to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when an authenticated attacker injects arbitrary web scripts that execute when an administrator accesses the affected page.

Recommendations Update to version 6.6.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Aabideen Bangash

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers