CVE-2023-53916

Medium · 4.6

CVSS

4.6

EPSS

0.3%

Published

Dec 17, 2025

CISA due date

—

The record

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the admin-users.php interface. When administrators view user information imported as HTML, malicious JavaScript payloads injected into the postal code field execute in their browser context.

Affected packages

Ecosystem	Package	Introduced	Fixed