Medium severity5.4NVD Advisory· Published Jun 30, 2017· Updated Jun 17, 2026
CVE-2015-9102
CVE-2015-9102
Description
Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
36.0+ 2 more
- (no CPE)range: 6.0
- cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*range: <=6.3-2960
- (no CPE)range: <6.0-2638, <6.3-2962
Patches
Vulnerability mechanics
References
5- www.fortiguard.com/zeroday/FG-VD-15-103nvdThird Party Advisory
- www.fortiguard.com/zeroday/FG-VD-15-104nvdThird Party Advisory
- www.fortiguard.com/zeroday/FG-VD-15-109nvdThird Party Advisory
- www.fortiguard.com/zeroday/FG-VD-15-112nvdThird Party Advisory
- www.synology.com/en-global/support/security/Photo_Station_6_3_2962nvdVendor Advisory
News mentions
0No linked articles in our index yet.