{"id":"CVE-2026-19230","state":"PUBLISHED","title":"SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting","description":"A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.","publishedAt":"2026-08-07T18:15:09.140Z","updatedAt":"2026-08-07T18:58:22.870Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Photo Share Website"],"affected":[{"vendor":"SourceCodester","product":"Photo Share Website","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*"],"modules":["Comment Input Box"]}],"references":["https://vuldb.com/vuln/386994","https://vuldb.com/vuln/386994/cti","https://vuldb.com/cve/CVE-2026-19230","https://vuldb.com/submit/864910","https://github.com/Andyov0/cve/issues/1","https://www.sourcecodester.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19230.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19230","state":"PUBLISHED","datePublished":"2026-08-07T18:15:09.140Z","dateUpdated":"2026-08-07T18:58:22.870Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-07T10:40:54.869Z"},"containers":{"cna":{"title":"SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used."}],"affected":[{"vendor":"SourceCodester","product":"Photo Share Website","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:photo_share_website:*:*:*:*:*:*:*:*"],"modules":["Comment Input Box"]}],"references":[{"url":"https://vuldb.com/vuln/386994","name":"VDB-386994 | SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/386994/cti","name":"VDB-386994 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19230","name":"CVE-2026-19230 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/864910","name":"Submit #864910 | SourceCodester Photo Share Website  V1.0 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/Andyov0/cve/issues/1","tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-07T18:15:09.140Z"},"timeline":[{"time":"2026-08-07T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-07T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-07T12:46:00.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Andyqaq (VulDB User)","type":"reporter"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-07T18:58:16.390348Z","id":"CVE-2026-19230","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-07T18:58:22.870Z"}}]}}}