CVE-2015-9102

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-30 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.

Affected products

Synology Photo Station: through 6.3-2960

References

http://www.fortiguard.com/zeroday/FG-VD-15-103
http://www.fortiguard.com/zeroday/FG-VD-15-104
http://www.fortiguard.com/zeroday/FG-VD-15-109
http://www.fortiguard.com/zeroday/FG-VD-15-112
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962
http://www.fortiguard.com/zeroday/FG-VD-15-103
http://www.fortiguard.com/zeroday/FG-VD-15-104
http://www.fortiguard.com/zeroday/FG-VD-15-109
http://www.fortiguard.com/zeroday/FG-VD-15-112
https://www.synology.com/en-global/support/security/Photo_Station_6_3_2962

Get alerted when CVE-2015-9102 or the next vulnerability affects your stack