30657 matches found
CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2022-51008
PocketMine-MP versions prior to 4.12.3 are vulnerable to a denial-of-service via unauthenticated session exhaustion. The server fails to limit connections that have not yet completed authentication, so an attacker can flood it with connections that occupy max-player slots without ever sending a L...
EUVD-2022-56035
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2022-51008: Allocation of Resources Without Limits or Throttling
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
PT-2026-86516
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without sending LoginPacket. Attackers can flood the server with unauthenticated connections that occupy max-player slots, preventing legitimate players from joinin...
CVE-2026-84937
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937
The Video Player for YouTube WordPress plugin versions before 2.1.0 is vulnerable to SQL injection due to improper sanitization and escaping of user-supplied input within SQL statements. This flaw specifically affects users with the Contributor role and above, who can exploit the vulnerability to...
WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability
Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...
PT-2026-86449
CVE-2026-36433 ā Arbitrary code execution in Actions Semiconductor Media Player Utilities v.4.46 No signature. No checksum. No auth. Their own firmware update toolkit Production.dll + RdiskUpgrade.exe accepts any firmware you hand it over USB. https://t.co/meTetZ91W1 CVE...
PT-2026-86360
šØ CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-84937: Improper Neutralization of Special Elements used in an SQL Command
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
CVE-2026-81289
Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...
CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...
EUVD-2026-69925
Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...
CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...
CVE-2026-81289
CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...
CVE-2025-7963
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...