CVE-2025-13849

CVE-2025-13849 — Cool YT Player for WordPress : A stored XSS flaw exists in the Cool YT Player plugin for WordPress via the videoid parameter for versions up to 1.0. The vulnerability enables an authenticated attacker with Contributor+ privileges to inject script that executes when users view the...

CVE-2024-2906

Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73...

CVE-2019-12936

BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions...

PT-2026-1610

Name of the Vulnerable Software and Affected Versions The Cool YT Player plugin for WordPress versions prior to 1.1 Description The Cool YT Player plugin for WordPress is susceptible to Stored Cross-Site Scripting through the videoid parameter. Insufficient input sanitization and output escaping...

WordPress plugin Cool YT Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-13849: Improper Neutralization of Input During Web Page Generation

The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

WordPress Cool YT Player plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Gilang - DJ in WordPress Plugin Cool YT Player versions = 1.0...

CVE-2020-36910

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizardsystem.cgi pages. Attackers can exploit the 'NTPServerIP' parameter with default credentials to execute arbitrary shell commands as root...

CVE-2020-36916 TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions

TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers can leverage the 'Modify' permissions for authenticated users to replace executable files with malicious binaries and gain elevated system...

CVE-2020-36916 TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions

TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers can leverage the 'Modify' permissions for authenticated users to replace executable files with malicious binaries and gain elevated system...

CVE-2020-36910 Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizardsystem.cgi pages. Attackers can exploit the 'NTPServerIP' parameter with default credentials to execute arbitrary shell commands as root...

CVE-2020-36910

Summary: CVE-2020-36910 affects Cayin Signage Media Player 3.0. An authenticated remote command injection exists in the system.cgi and wizard_system.cgi pages, exploitable via the NTP_Server_IP parameter with default credentials to run arbitrary shell commands as root. The vulnerability has a hig...

Malicious code in electra-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e90e20a5f518415d7ac86fad709a8ea6499445e427dab71949d06f62ace2dded The package electra-web-player was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-1110

Malicious code in electra-web-player npm...

Malicious Package

Overview electra-web-player is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-86 Malicious code in electra-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e90e20a5f518415d7ac86fad709a8ea6499445e427dab71949d06f62ace2dded The package electra-web-player was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-1109

Malicious code in electra-web-player-event npm...

Malicious code in electra-web-player-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45f583354472166aa4f724b9fde7ec74f8d56151edda6123bceaa5ac3560dab2 The package electra-web-player-event was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview electra-web-player-event is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-87 Malicious code in electra-web-player-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45f583354472166aa4f724b9fde7ec74f8d56151edda6123bceaa5ac3560dab2 The package electra-web-player-event was found to contain malicious code. Source: ghsa-malware...