CVE-2015-2983

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in admin.php in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote attackers to hijack the authentication of arbitrary users.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN78240242/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000114Vendor Advisory
http://www.php-factory.net/trivia/16.phpVendor Advisory
http://jvn.jp/en/jp/JVN78240242/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000114Vendor Advisory
http://www.php-factory.net/trivia/16.phpVendor Advisory

Timeline

Published: Aug 22, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-29845.0I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP re CVE-2015-29854.3Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via CVE-2015-29864.3Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HT CVE-2015-29872.6Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differ CVE-2015-29887.4Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middl CVE-2015-29894.3Cross-site scripting (XSS) vulnerability in index.php in LEMON-S PHP Twit BBS allows remote attackers to inject arbitrary web script or HTML CVE-2015-29904.0Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arb CVE-2015-29916.8Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.CVE-2015-29926.1Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.CVE-2015-29937.5SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create adminis CVE-2015-29946.5Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary CVE-2015-29956.8The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload an