Citrix Workspace App for HTML5 Multiple Vulnerabilities (CTX678037)

The version of Citrix Workspace App for HTML5 installed on the remote host is prior to 2404.1. It is therefore affected by multiple vulnerabilities as described in the CTX678037 advisory: - Bypass of GACS Policy Configuration settings CVE-2024-6148 - Redirection of users to a vulnerable URL...

CVE-2024-6148

Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5...

CVE-2024-6149

Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5...

CVE-2024-6148

Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5...

CVE-2024-6148

Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5...

CVE-2024-6148

CVE-2024-6148 affects Citrix Workspace app for HTML5 prior to version 2404.1. The Citrix CTX678037 security bulletin documents two vulnerabilities: (1) bypass of GACS Policy Configuration settings, and (2) redirection of users to a vulnerable URL (CVE-2024-6149). The issue originates in the HTML5...

PT-2024-5729 · Citrix · Citrix Workspace App For Html5

Name of the Vulnerable Software and Affected Versions: Citrix Workspace app for HTML5 affected versions not specified Description: The issue is related to a bypass of GACS Policy Configuration settings in the Citrix Workspace app for HTML5. This is due to incorrect default permissions. Exploitati...

WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Html5 Audio Player versions = 2.2.23...

WordPress Html5 Audio Player Plugin <= 2.2.23 is vulnerable to Cross Site Scripting (XSS)

Software Html5 Audio Player Type Plugin Vulnerable versions = 2.2.23 Fixed in 2.2.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 47b25ff82d31 Credits LVT-tholv2k Required privilege...

CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2024-5522 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2024-5522

Summary: CVE-2024-5522 affects the WordPress HTML5 Video Player plugin (

CVE-2024-5522 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

Citrix Workspace App for HTML5 - Chromium Update Impact on Multi Monitor Functionality

When you click Multimonitor from the session toolbar, the session might not extend automatically. The issue occurs when you use Citrix Workspace app for HTML5 version that is earlier than 2404, and the Google Chromium browser version is equal to or greater than v125.0.0...

Exploit for SQL Injection in Bplugins Html5_Video_Player

CVE-2024-5522-Poc CVE-2024-5522 HTML5 Video Player = 2.5.2...

WordPress HTML5 Video Player plugin < 2.5.27 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Mayank Deshmukh in WordPress Plugin Flash & HTML5 Video versions 2.5.27...

WordPress Flash & HTML5 Video Plugin < 2.5.27 is vulnerable to SQL Injection

Software Flash & HTML5 Video Type Plugin Vulnerable versions 2.5.27 Fixed in 2.5.27 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5522 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a6949d7fc215 Credits Mayank Deshmukh Required privilege...

PT-2024-36495 · WordPress · Html5 Video Player

Name of the Vulnerable Software and Affected Versions: HTML5 Video Player WordPress plugin versions prior to 2.5.27 Description: The issue concerns a failure to sanitize and escape a parameter from a REST route before using it in a SQL statement. This allows unauthenticated users to perform SQL...

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Description The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks PoC % time curl "https://example.com/?restroute=/h5vp/v1/video/1=1'+OR+SELECT+1+FROM+SELECTSLEEP5xyz--+-"...