Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Uphotogallery allows attacker to insert malicious script in thumbnails

CVE-2006-3023 · published 20 years ago
Summary

The Uphotogallery 1.1 web gallery lets a remote user place harmful code into the thumbnail page by manipulating the s or block inputs. This can make the gallery show unwanted scripts or HTML to anyone who views the page, potentially stealing data or hijacking the site. Update the software or apply a patch that properly sanitises those inputs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
uapplication uphotogallery <= 1.1
cpe:2.3:a:uapplication:uphotogallery:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in thumbnails.asp in Uapplication Uphotogallery 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s and (...
Multiple cross-site scripting (XSS) vulnerabilities in thumbnails.asp in Uapplication Uphotogallery 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) block parameters.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published15 Jun 2006
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-3023 · NVD
Track software like this
Free during beta