When was CVE-2015-5593 made public?

CVE-2015-5593 was made public on July 10, 2015: that is the date its CVE record's CNA, MITRE Corporation, gives for when the vulnerability was made public. The CVE record itself was published on December 31, 2019. EchelonGraph's copy of the record carries a last-modified date of November 21, 2024; the record at its source may have been updated since.

Is CVE-2015-5593 actively exploited?

CVE-2015-5593 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1.1% probability of exploitation in the next 30 days (64th percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2015-5593?

CVE-2015-5593 has a CVSS v3 base score of 6.1 (NVD).

CVE-2015-5593

MEDIUMNVD 6.16.1

Also known asEUVD-2015-5547 (ENISA EUVD) · GHSA-qhj3-pr62-6wjx (GitHub Security Advisories)Source: ENISA EUVD

6.1EG

EchelonGraph verdictMonitorNo fix on record since 2019: if the vendor still supports the product, apply the fixed version it names within your standard update timelines; if it no longer does, isolate the affected system on your normal schedule, or retire the product (the SSVC decision on this page).

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 1.1%CVSS: 6.1Exploit: None knownExposed services: Not assessed

No fix has been recorded since the CVE record was published in 2019 — if the vendor still supports the product, apply the fixed version it names; if not, isolate the affected system (restrict network access to it, for example with a firewall, or keep it off the internet) or retire the product.

The CVE record's description, written by its CNA (MITRE Corporation), states the affected versions: "The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "<<script></script>script…" No release containing a fix is confirmed on record.

The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "