TI-2005-00721 Aliases CVE-2005-0777 GHSA-gf5v-q674-r98m

Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote…

LOW 22Published 2005-03-20 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP 5.0 RC3 allow remote attackers to inject arbitrary web script or HTML via (1) the check_tags function or (2) the editbio field in the user profile.

Why it matters now

EPSS 0.01208 68th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:photopost:photopost_php_pro:5.0_rc3:::::::*	5.0_rc3	Vulnerable	Photopost

cpe:2.3:a:photopost:photopost_php_pro:5.0_rc3:*:*:*:*:*:*:* Versions 5.0_rc3 Vulnerable ·Photopost

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2005-0777
2026-10-03 Alias added: GHSA-gf5v-q674-r98m

References

Other 1

20050311 PhotoPost PHP 5.0 RC3, and later, multiple vulnerabilities

TI-2004-00219 SQL injection vulnerability in PhotoPost PHP Pro 4.6 and earlier allows remote attackers… CVSS 2.0HIGH 10.0
TI-2004-00208 SQL injection vulnerability in showphoto.php in PhotoPost PHP Pro 4.6 and earlier allows… CVSS 2.0HIGH 10.0
TI-2006-04658 PHP remote file inclusion vulnerability in zipndownload.php in PhotoPost 4.0 through 4.6… CVSS 2.0HIGH 7.5
TI-2006-04808 Multiple PHP remote file inclusion vulnerabilities in PhotoPost allow remote attackers to… CVSS 2.0HIGH 7.5
TI-2005-01538 SQL injection vulnerability in member.php for Photopost PHP Pro allows remote attackers… CVSS 2.0HIGH 7.5
TI-2005-00719 The reportpost action in misc.php for PhotoPost PHP 5.0 RC3 does not limit the logging… CVSS 2.0HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences