Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2008-1296: EncapsGallery 1.11.2 lets attackers insert malicious code
CVE-2008-1296 · published 18 years ago
Summary
The web gallery software EncapsGallery version 1.11.2 can be tricked into showing harmful scripts or HTML when a specially crafted file name is sent to its watermark or catalog pages. An attacker could use this to run unwanted actions in a visitor's browser, potentially stealing data or hijacking sessions. Update to a patched version or apply vendor-provided fixes to block the unsafe input.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| encaps | encapsgallery |
1.11.2 cpe:2.3:a:encaps:encapsgallery:1.11.2:*:*:*:*:*:*:* |
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to (1) watermark.php and (2) catalog...
Multiple cross-site scripting (XSS) vulnerabilities in EncapsGallery 1.11.2 allow remote attackers to inject arbitrary web script or HTML via the file parameter to (1) watermark.php and (2) catalog_watermark.php in core/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Mar 2008
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-1296 · NVD
Track software like this
Free during beta