Cross-site scripting (XSS) vulnerability in php/editphotos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) photographerid or (2) _crumb parameter.