CVE-2012-0995: Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbi...

Security readout for executives and security teams

ZENphoto 1.4.2 had multiple cross-site scripting flaws that could let a remote attacker inject script or HTML into vulnerable pages. For a business, the main concern is user or administrator browser compromise, especially if an exposed gallery admin area is still running this old release. Exposure is most likely on internet-facing Zenphoto 1.4.2 installations, particularly where admin paths are reachable. The supplied affected-product metadata is incomplete, so validation should focus on actual Zenphoto deployments and version evidence. Prioritize remediation if Zenphoto is public-facing or used by administrators with privileged sessions. The issue is old and lacks supplied active-exploitation evidence, but exposed legacy CMS software is a practical security liability. Mitigation focus: Identify and retire any ZENphoto 1.4.2 deployments.; Review Zenphoto 1.4.2.1 and cited vendor changesets for the applicable fix.; Upgrade to a vendor-supported fixed release where possible..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.