{"id":"CVE-2026-82482","summary":"coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting","details":"A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.","modified":"2026-10-30T10:30:19.511208182Z","published":"2026-08-30T06:15:07.449Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.0"},{"last_affected":"1.6.0"},{"introduced":"1.6.1"},{"last_affected":"1.6.1"},{"introduced":"1.6.2"},{"last_affected":"1.6.2"},{"introduced":"1.6.3"},{"last_affected":"1.6.3"},{"introduced":"1.6.4"},{"last_affected":"1.6.4"},{"introduced":"1.6.5"},{"last_affected":"1.6.5"},{"introduced":"1.6.6"},{"last_affected":"1.6.6"},{"introduced":"1.6.7"},{"last_affected":"1.6.7"},{"introduced":"1.6.8"},{"last_affected":"1.6.8"},{"introduced":"1.6.9"},{"last_affected":"1.6.9"}]}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-79","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82482.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82482.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82482"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-82482"},{"type":"ADVISORY","url":"https://vuldb.com/submit/888334"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/397032"},{"type":"REPORT","url":"https://vuldb.com/vuln/397032/cti"},{"type":"FIX","url":"https://github.com/coppermine-gallery/cpg1.6.x/releases/tag/v1.6.29"},{"type":"EVIDENCE","url":"https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_biography.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coppermine-gallery/cpg1.6.x","events":[{"introduced":"a3a65b3da54960b46e0feaa6b8db9161a7e79e20"},{"fixed":"cdc77aa93be5f5f1961cb4c8269987be95d010f6"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.6.10"},{"last_affected":"1.6.10"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.11"},{"last_affected":"1.6.11"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.12"},{"last_affected":"1.6.12"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.13"},{"last_affected":"1.6.13"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.6.15"},{"last_affected":"1.6.15"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.14"},{"last_affected":"1.6.14"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.6.16"},{"last_affected":"1.6.16"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.17"},{"last_affected":"1.6.17"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.18"},{"last_affected":"1.6.18"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.19"},{"last_affected":"1.6.19"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.6.20"},{"last_affected":"1.6.20"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"1.6.21"},{"last_affected":"1.6.21"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.22"},{"last_affected":"1.6.22"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.23"},{"last_affected":"1.6.23"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.24"},{"last_affected":"1.6.24"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"1.6.25"},{"last_affected":"1.6.25"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.26"},{"last_affected":"1.6.26"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.27"},{"last_affected":"1.6.27"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.6.28"},{"last_affected":"1.6.28"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"cdc77aa93be5f5f1961cb4c8269987be95d010f6"}],"source":"REFERENCES_TAG","original_tag":"v1.6.29"}]}}],"versions":["1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.16","1.6.17","1.6.18","1.6.19","1.6.20","1.6.21","1.6.22","1.6.23","1.6.24","1.6.25","1.6.26","1.6.27","1.6.28","v1.6.28","v1.6.27","v1.6.26","v1.6.25","v1.6.24","v1.6.23","v1.6.22","v1.6.21","v1.6.20","v1.6.19","v1.6.18","v1.6.17","v1.6.16","v1.6.15","v1.6.13","v1.6.14","v1.6.12","v1.6.11","v1.6.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82482.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}]}