Coppermine Gallery

CVE-2026-82482 Aug 30, 06:15 LOW POC PATCH Monitor

Stored cross-site scripting in Coppermine Photo Gallery up to version 1.6.28 allows an authenticated user to inject malicious JavaScript into the Biography field of the edit_profile endpoint in profile.php, which executes in the browser of any user who subsequently views that profile. A public proof-of-concept exploit is available on GitHub (Leousum/VulnPoC), and the vendor has released version 1.6.29 to remediate the issue. No active exploitation is confirmed in the CISA KEV catalog, but the PoC lowers the practical barrier to abuse significantly.

CVE-2015-6528 Aug 20, 20:59 MEDIUM POC This Month

Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

CVE-2015-3923 Jun 10, 18:59 MEDIUM POC This Month

Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2015-3922 May 27, 18:59 MEDIUM This Month

Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2015-3921 May 27, 18:59 LOW Monitor

Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web script or HTML via the referer parameter. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2012-1614 Sep 04, 20:55 MEDIUM POC PATCH THREAT This Month

Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 14.1%.

CVE-2012-1613 Sep 04, 20:55 LOW POC PATCH Monitor

Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.