CVE-2023-53939

MEDIUM

TinyWebGallery 2.5 - Authenticated Stored Cross-Site Scripting via Folder Name Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-53939. PoCs published by Mirabbas Ağalarov.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in TinyWebGallery v2.5 by injecting a malicious script into the folder name field, which is then executed when the page is loaded.

Description

TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.

Exploits (1)

exploitdb WORKING POC
by Mirabbas Ağalarov · textwebappsphp
https://www.exploit-db.com/exploits/51442

This exploit demonstrates a stored XSS vulnerability in TinyWebGallery v2.5 by injecting a malicious script into the folder name field, which is then executed when the page is loaded.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: TinyWebGallery v2.5
Auth required
Prerequisites: Authenticated access to the TinyWebGallery application
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/51442

Scores

CVSS v3 5.4
EPSS 0.0020
EPSS Percentile 10.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
tinywebgallery/tinywebgallery 2.5
TinyWebGallery/TinyWebGallery 2.5
Published Dec 18, 2025
Tracked Since Feb 18, 2026