Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

CVE-2023-38516

CVE-2023-38516 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin versions <= 1.2.2. The root cause is a stored XSS in the plugin that can be triggered by an attacker with Contributor+ permissions....

CVE-2023-38516 WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

CVE-2023-38516 WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

CVE-2023-38516: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

WordPress plugin Audio Player with Playlist Ultimate Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2023-26493 · Unknown +1 · Wp Onlinesupport +1

Name of the Vulnerable Software and Affected Versions: WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin versions 1.2.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher...

GOM Player 2.3.90.5360 MITM / Remote Code Execution Exploit

GOM Player version 2.3.90.5360 man-in-the-middle proof of concept remote code execution exploit. Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution RCE Author: M. Akil Gündoğan Contact: https://twitter.com/akilgundogan Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/...

GOM Player 2.3.90.5360 MITM / Remote Code Execution

Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution RCE Date: 26.08.2023 Author: M. Akil Gündoğan Contact: https://twitter.com/akilgundogan Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/ Software Link: https://cdn.gomlab.com/gretech/player/GOMPLAYERGLOBALSETUPNEW.EXE...

WordPress FV Flowplayer Video Player Plugin <= 7.5.37.7212 is vulnerable to Cross Site Scripting (XSS)

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.37.7212 Fixed in 7.5.39.7212 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4520 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d232095d565d...

CVE-2023-4520: Improper Neutralization of Input During Web Page Generation

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fvplayeruservideo’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and...

PT-2023-29453

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player plugin for WordPress versions up to, and including, 7.5.37.7212 Description The issue affects the FV Flowplayer Video Player plugin for WordPress, allowing Stored Cross-Site Scripting via the fv player user video...

WordPress plugin FV Flowplayer Video Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-27490 · Lg · Lg Simple Editor

Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this issue, the...

CVE-2023-30499

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

CVE-2023-30499 WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

CVE-2023-30499

CVE-2023-30499 refers to an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the FolioVision FV Flowplayer Video Player plugin for WordPress, affected versions

CVE-2023-30499: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

Improver Validation of File Name Causes RCE

Description Due to insufficient sanitization of the music file name, it is possible to execute arbitrary commands on the victims computer, through a specially crafted file name. Note that this bug was only found exploitable only on the MacOS version of this application. Although still applicable ...