Improver Validation of File Name Causes RCE

Description Due to insufficient sanitization of the music file name, it is possible to execute arbitrary commands on the victims computer, through a specially crafted file name. Note that this bug was only found exploitable only on the MacOS version of this application. Although still applicable ...

WordPress Video gallery and Player Plugin <= 2.6.5 is vulnerable to Broken Access Control

Software Video gallery and Player Type Plugin Vulnerable versions = 2.6.5 Fixed in 2.6.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 27dbac5e56cd Credits Abdi Pranata Require...

WebChess SQL注入漏洞

WebChess is a web-based online chess game. A SQL injection vulnerability exists in webchess v1.0, which originates from the lack of validation of the $playerID parameter in mainmenu.php against external SQL input. This vulnerability can be exploited by attackers to execute illegal SQL commands to...

Malicious code in progress-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7c85d0514dd6025ca318ffb0b25040d4c1ef626b00125f13d43ea506d3299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Minecraft fans beware: Players and servers at risk from BleedingPipe vulnerability

Minecraft players interested in modding are potentially at risk of compromise. A Remote Code Execution RCE vulnerability in certain Minecraft mods allows for malicious commands on both servers and clients. The vulnerability, named BleedingPipe, allows attackers to take over a targeted server...

PT-2023-27345 · WordPress · Radio Player

Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue is related to a missing capability check on the delete player function, allowing unauthenticated attackers to modify data by deleting player...

CVE-2023-37976

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

CVE-2023-37976

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

CVE-2023-37976 WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Radio Forge Muses Player with Skins plugin = 2.5 versions...

CVE-2023-37976

CVE-2023-37976: Unauthenticated Reflected Cross-Site Scripting in WordPress Radio Forge Muses Player with Skins plugin (versions &lt;= 2.5). The connected sources confirm the vulnerability is XSS with unauthenticated exposure and no publicly documented fix/version yet. Wordfence entries list the ...

WordPress Plugin Radio Forge Muses Player with Skins 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Audio Player with Playlist Ultimate Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-38516 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dabac0be2565 Credits Rio...

WordPress Super Video Player Plugin < 1.6.13 is vulnerable to Cross Site Scripting (XSS)

Software Super Video Player Type Plugin Vulnerable versions 1.6.13 Fixed in 1.6.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2d8b09b91b6 Credits Rafie Muhammad Patchstack...

WordPress Live TV Player – Worldwide Live TV Channels Player for WordPress Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Live TV Player – Worldwide Live TV Channels Player for WordPress Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Video Player for YouTube Plugin < 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Video Player for YouTube Type Plugin Vulnerable versions 1.5.3 Fixed in 1.5.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3d6bf7dd95eb Credits Rafie Muhammad Patchstack...

WordPress Radio Player Plugin < 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Radio Player Type Plugin Vulnerable versions 2.0.5 Fixed in 2.0.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3e0bf7a12bee Credits Rafie Muhammad Patchstack Required...

WordPress Quick Audio Player – Best HTML5 Audio Player Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Quick Audio Player – Best HTML5 Audio Player Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1caa9fec69d5 Credits Rafie...

WordPress Music Player for Elementor – Audio Player & Podcast Player Plugin < 1.5.9.9 is vulnerable to Cross Site Scripting (XSS)

Software Music Player for Elementor – Audio Player & Podcast Player Type Plugin Vulnerable versions 1.5.9.9 Fixed in 1.5.9.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

Malicious code in wm-webpack-player-sri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce8f86b27a02853a91d351ebf67ea4c8b697d62b1c65c295b7a01cfa89148ec The OpenSSF Package Analysis project identified 'wm-webpack-player-sri' @ 0.0.71 npm as malicious. It is considered malicious because: - The...