CVE-2026-19209
Received Received - Intake

Cross-Site Scripting in Photo Share Website 1.0

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19209
EUVD
EUVD-2026-54509

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester photo_share_website 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Photo Share Website 1.0. It allows attackers to inject malicious scripts via the Comment parameter in the file /social/index.php?page=home. The scripts are stored in the database and executed when users view the affected photo pages.

Detection Guidance

Check for unusual comments in the Photo Share Website's gallery pages containing script tags like <script>alert(1)</script>. Inspect network requests to ajax.php for POST data with the 'comment' parameter containing suspicious payloads. Use browser developer tools to monitor for unexpected script execution on page load.

Impact Analysis

An attacker could steal user session cookies, redirect users to malicious sites, or perform actions on behalf of users. Victims may unknowingly execute harmful scripts when viewing photo galleries, leading to account compromise or data theft.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face fines or legal consequences for failing to protect user information from such attacks.

Mitigation Strategies

Disable or restrict user comment functionality until a patch is applied. Implement input validation to strip or encode HTML/script tags in the 'comment' parameter. Update the application to use prepared statements if storing comments in a database. Monitor for and remove any existing malicious comments from the database.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart