CVE-2026-19230
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in SourceCodester Photo Share Website 1.0 affects an unknown part of the file /social/ajax.php?action=save_upload of the Comment Input Box component. Manipulation of the content argument leads to cross site scripting. The attack may be initiated remotely, and the exploit is publicly available.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or other harmful actions.
Recommendation
Apply patches immediately or restrict access to the application. Also sanitize input in the content argument and implement XSS protection mechanisms.
Other vulnerabilities in SourceCodester Photo Share Website
See all- CVE-2026-19211High
A vulnerability was found in SourceCodester Photo Share Website 1.0. It affects an unknown function in the file /social/ajax.php?action=signup. Manipulation of the email argument results in SQL injection. Remote exploitation is possible. The exploit has been made public and could be used.
- CVE-2026-19210Medium
A vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/ajax.php?action=save_upload. Manipulation of the img[]/imgName[] arguments leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-19209Low
A cross-site scripting vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/index.php?page=home. Manipulation of the Comment argument causes XSS. The attack can be initiated remotely and the exploit is public.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS