Low severity · published Aug 30, 2026
CVE-2026-82482
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Coppermine Photo Gallery · coppermine-gallery
1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +23 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82482
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82482
github.com
https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_biography.md
github.com
https://github.com/coppermine-gallery/cpg1.6.x/releases/tag/v1.6.29
vuldb.com
https://vuldb.com/cve/CVE-2026-82482
vuldb.com
https://vuldb.com/submit/888334
vuldb.com
https://vuldb.com/vuln/397032
vuldb.com
https://vuldb.com/vuln/397032/cti
More from Coppermine Photo Gallery
8.8
CVE-2023-53868
Coppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload
6.1
CVE-2018-14478
ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter
6.1
CVE-2014-4612
Cross-site scripting (XSS) vulnerability in the keywords manager (keywordmgr.php) in Coppermine Photo Gallery before 1.5.27 and 1.6.x before 1.6.01 allows remote attackers to…
3.5
CVE-2026-82483
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
–
CVE-2015-6528
Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML…