CVE-2022-25229

2022-05-2011:15:07

Google

osv.dev

popcorn time

stored xss

movies api server(s)

settings

nodejs

os commands

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Popcorn Time 0.4.7 has a Stored XSS in the ‘Movies API Server(s)’ field via the ‘settings’ page. The ‘nodeIntegration’ configuration is set to on which allows the ‘webpage’ to use ‘NodeJs’ features, an attacker can leverage this to run OS commands.