2 matches found
CVE-2022-25229
Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...
5.4CVSS5.7AI score0.00558EPSS
SaveExploits1References2
CVE-2022-25229: Improper Neutralization of Input During Web Page Generation
Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...
5.4CVSS6AI score0.00558EPSS
SaveExploits1References2
20