PT-2023-26493 · Unknown +1 · Wp Onlinesupport +1

Name of the Vulnerable Software and Affected Versions: WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin versions 1.2.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher...

GOM Player 2.3.90.5360 MITM / Remote Code Execution Exploit

GOM Player version 2.3.90.5360 man-in-the-middle proof of concept remote code execution exploit. Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution RCE Author: M. Akil Gündoğan Contact: https://twitter.com/akilgundogan Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/...

GOM Player 2.3.90.5360 MITM / Remote Code Execution

Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution RCE Date: 26.08.2023 Author: M. Akil Gündoğan Contact: https://twitter.com/akilgundogan Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/ Software Link: https://cdn.gomlab.com/gretech/player/GOMPLAYERGLOBALSETUPNEW.EXE...

WordPress FV Flowplayer Video Player Plugin <= 7.5.37.7212 is vulnerable to Cross Site Scripting (XSS)

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.37.7212 Fixed in 7.5.39.7212 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4520 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d232095d565d...

WordPress plugin FV Flowplayer Video Player has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-4520: Improper Neutralization of Input During Web Page Generation

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fvplayeruservideo’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and...

PT-2023-29453

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player plugin for WordPress versions up to, and including, 7.5.37.7212 Description The issue affects the FV Flowplayer Video Player plugin for WordPress, allowing Stored Cross-Site Scripting via the fv player user video...

PT-2023-27490 · Lg · Lg Simple Editor

Name of the Vulnerable Software and Affected Versions: LG Simple Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this issue, the...

CVE-2023-30499

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

CVE-2023-30499 WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

CVE-2023-30499

CVE-2023-30499 refers to an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the FolioVision FV Flowplayer Video Player plugin for WordPress, affected versions

CVE-2023-30499: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in FolioVision FV Flowplayer Video Player plugin = 7.5.32.7212 versions...

Improver Validation of File Name Causes RCE

Description Due to insufficient sanitization of the music file name, it is possible to execute arbitrary commands on the victims computer, through a specially crafted file name. Note that this bug was only found exploitable only on the MacOS version of this application. Although still applicable ...

WordPress Video gallery and Player Plugin <= 2.6.5 is vulnerable to Broken Access Control

Software Video gallery and Player Type Plugin Vulnerable versions = 2.6.5 Fixed in 2.6.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 27dbac5e56cd Credits Abdi Pranata Require...

WebChess SQL Injection Vulnerability

WebChess is a web-based online chess game. A SQL injection vulnerability exists in webchess v1.0, which originates from the lack of validation of the $playerID parameter in mainmenu.php against external SQL input. This vulnerability can be exploited by attackers to execute illegal SQL commands to...

Malware in progress-player

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in progress-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7c85d0514dd6025ca318ffb0b25040d4c1ef626b00125f13d43ea506d3299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Minecraft fans beware: Players and servers at risk from BleedingPipe vulnerability

Minecraft players interested in modding are potentially at risk of compromise. A Remote Code Execution RCE vulnerability in certain Minecraft mods allows for malicious commands on both servers and clients. The vulnerability, named BleedingPipe, allows attackers to take over a targeted server...

PT-2023-27345 · WordPress · Radio Player

Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue is related to a missing capability check on the delete player function, allowing unauthenticated attackers to modify data by deleting player...