ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 임의 파일 삭제 PoC ★ 설명 CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p 예시 python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test -i...

CVE-2026-104673

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2026-104673 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2026-104673

The Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (versions n/a through 5.14.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability could allow an attacker to execut...

EUVD-2026-92318

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.14.2...

CVE-2019-9766

CVE-2019-9766 Free MP3 CD Ripper 2.6 버전에 존재하는 버퍼 오버플로 취약점을 이용하여 특수하게 조작된 MP3 파일을 생성합니다. 공격자가 플레이어로 해당 파일을 재생할 때, 오디오 파일 미끼가 버퍼 오버플로 취약점을 이용해 임의 코드를 실행합니다. 재현 공격 머신: kali201903 192.168.198.142 피해 머신: windows10 21H1 192.168.198.137 피해 머신에 Free MP3 CD Ripper 2.6을 설치한 후, kali 머신에서 MSF를 이용하여 리버스 연결 셸코...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

EUVD-2014-9822

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2019-9766

CVE-2019-9766 최선을 다하겠습니다 CVE 정보 Free MP3 CD Ripper .mp3 파일과 다른 파일 형식 간의 변환기입니다 파일 변환. 버그 NVD에 따르면, vision 2.6에서 버퍼 영역의 스택 기반 오버플로우stack-based overflow가 발견되었습니다. 따라서 이에 대한 PoC를 만들 수 있습니다. 파일 형식을 .mp3로 변경하고 원격으로 공격합니다. 취약 버전 Free MP3 CD Ripper 2.6 환경 공격자: Ubuntu18.04.2lts 피해자: Windows10에...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-87961 ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-87961: Out-of-bounds Read

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the readID3Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

PT-2026-89359

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read ID3 Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size...

CVE-2026-81289

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...