EUVD-2026-54572
GHSA-395c-4p59-c3px
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring low-privilege comment submission and victim page view; scope changes to victim browser context enabling script execution with limited C and I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
AnalysisAI
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the content parameter of the comment input box at /social/ajax.php?action=save_upload, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
Technical ContextAI
The affected application is a PHP-based social photo-sharing platform developed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*). The vulnerable endpoint /social/ajax.php?action=save_upload processes comment submissions through the content POST parameter. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): user-supplied input is insufficiently sanitized or HTML-encoded before being embedded into rendered page output, allowing script injection payloads to execute in victim browsers. The wildcard version in the CPE string suggests all known versions are potentially affected, with 1.0 explicitly confirmed. SourceCodester distributes this application as a downloadable PHP project primarily for educational and demonstration use.
RemediationAI
No vendor-released patch has been identified at time of analysis. The immediate code-level fix is to apply proper output encoding to the content parameter before rendering it in any HTML context - in PHP, applying htmlspecialchars($content, ENT_QUOTES, 'UTF-8') at the point of output in the comment rendering logic within or downstream of /social/ajax.php?action=save_upload would neutralize the injection. As a compensating control, deploying a Web Application Firewall rule targeting script injection patterns (e.g., <script>, onerror=, javascript:) in the content POST parameter to this endpoint can reduce exposure, though WAF rules introduce bypass risk via encoding variants and require ongoing maintenance. Restricting comment submission to verified or higher-trust user roles reduces attacker opportunity surface if the application's user model supports role tiers. Monitor the VulDB advisory at https://vuldb.com/vuln/386994 and the exploit reference at https://github.com/Andyov0/cve/issues/1 for any upstream patch release. Given the absence of an active upstream patch and the application's educational-project nature, production operators should strongly consider replacing the component with a maintained alternative.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today