Medium severity · published Mar 16, 2018
CVE-2014-4612
Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remote attackers to…
6.1
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Coppermine Photo Gallery · Coppermine-gallery
before 1.5.28; 1.6.0 before 1.6.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4612
forum.coppermine-gallery.net
http://forum.coppermine-gallery.net/index.php/topic%2C77376.0.html
Mailing List
http://seclists.org/oss-sec/2014/q2/608
Mailing List
http://seclists.org/oss-sec/2014/q2/620
Patch
http://sourceforge.net/p/coppermine/code/8674
Third Party Advisory
http://www.securityfocus.com/bid/68140
Release Notes
https://sourceforge.net/p/coppermine/code/8674/tree//trunk/cpg1.5.x/CHANGELOG.txt
More from Coppermine Photo Gallery
8.8
CVE-2023-53868
Coppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload
6.1
CVE-2018-14478
ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter
3.5
CVE-2026-82483
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
3.5
CVE-2026-82482
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
–
CVE-2015-6528
Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML…