Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2014-9236
Advisory ID ubuntu_osv/UBUNTU-CVE-2014-9236
Aliases CVE-2014-9236
Summary Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.
Status Published
Exploitability 2.0
Weighted Severity 2.7
Risk 5.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority low https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-9236.json
Reference id Reference type URL
http://seclists.org/fulldisclosure/2014/Nov/45
https://github.com/jeroenrnl/zoph/issues/59
https://ubuntu.com/security/CVE-2014-9236
https://www.cve.org/CVERecord?id=CVE-2014-9236
Data source Exploit-DB
Date added Nov. 17, 2014
Description Zoph 0.9.1 - Multiple Vulnerabilities
Ransomware campaign use Unknown
Source publication date Nov. 17, 2014
Exploit type webapps
Platform php
Source update date Nov. 17, 2014

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.