Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-114611. PoCs published by waraxe.
AI-analyzed exploit summary This advisory details multiple vulnerabilities in Zenphoto 1.4.3.3, including SQL injection via the X_FORWARDED_FOR header, IP address spoofing, and a file type restriction bypass. The analysis includes code snippets, attack vectors, and preconditions for exploitation.
Description
ZenPhoto 1.4.3.3 - Multiple Vulnerabilities
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by waraxe · textwebappsphp
https://www.exploit-db.com/exploits/22524
This advisory details multiple vulnerabilities in Zenphoto 1.4.3.3, including SQL injection via the X_FORWARDED_FOR header, IP address spoofing, and a file type restriction bypass. The analysis includes code snippets, attack vectors, and preconditions for exploitation.
Classification
Writeup 100%
Attack Type
Sqli | Auth Bypass | Other
Complexity
Moderate
Reliability
Reliable
Target:
Zenphoto 1.4.3.3 and older
No auth needed
Prerequisites:
Plugin activation for some vulnerabilities · Admin privileges for file type restriction bypass
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026