PT-2026-69097
CVE-2026-19230
·
Published
2026-08-07
·
Updated
2026-10-23
Description by
CVSS 2.0
4.0
MediumMetricsAV:N/AC:L/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
SourceCodester Photo Share Website version 1.0
Description
Cross site scripting occurs when the
content argument is manipulated within the Comment Input Box component at the '/social/ajax.php?action=save upload' endpoint. This issue allows a remote attacker to execute malicious scripts in the context of the user's session.Recommendations
Update SourceCodester Photo Share Website version 1.0 to a version that addresses this issue.
As a temporary mitigation, restrict access to the '/social/ajax.php?action=save upload' endpoint or avoid using the
content parameter in the Comment Input Box.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾