{"id":"CVE-2014-9236","aliases":["DEBIAN-CVE-2014-9236","EUVD-2014-9061","GHSA-247w-9prv-x7gm","UBUNTU-CVE-2014-9236"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes...","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02645,"percentile":0.85701,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2014-12-03T21:00:00Z","modified":"2026-10-23T15:47:25Z","exploits":[{"source":"exploitdb","id":"EDB-35278","title":"Zoph 0.9.1 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2014-11-17","url":"https://www.exploit-db.com/exploits/35278"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-3","1.0.1-4","1.0.1-5","1.4-1","1.4-2","1.4-3"]},{"source":"osv","ecosystem":"Debian:13","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Debian:14","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.11-1","0.9.11-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.16-1","0.9.17-2","0.9.18-1","0.9.19-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-5","1.4-2","1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zoph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-3"]}],"products":[{"vendor":"zoph","product":"zoph"}],"references":[{"url":"http://packetstormsecurity.com/files/129141/Zoph-0.9.1-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://seclists.org/fulldisclosure/2014/Nov/45","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9236"},{"url":"https://github.com/advisories/GHSA-247w-9prv-x7gm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9236","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9236","tags":["report"]},{"url":"https://github.com/jeroenrnl/zoph/issues/59","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9236","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9236","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:00:00Z","modified":"2024-09-17T04:04:18.822Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9061","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:00:00Z","modified":"2024-09-17T04:04:18Z","updated_at":"2026-11-03T00:28:26.235396Z"}],"ghsa":[{"id":"GHSA-247w-9prv-x7gm","title":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes...","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2022-05-17T04:20:37Z","modified":"2023-01-28T05:01:39Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:36.071197Z"}],"nvd":[{"id":"CVE-2014-9236","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:59:06.04Z","modified":"2026-06-17T00:17:58.303Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-9236","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:59:06Z","modified":"2026-04-10T03:44:48.238969Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9236","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:59:06.04Z","modified":"2026-10-23T15:47:25.508285495Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9236","description":"Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographer_id or (2) _crumb parameter.","status":"published","published":"2014-12-03T21:59:00Z","modified":"2026-10-17T12:52:53.985612133Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}