PT-2024-36495 · WordPress · Html5 Video Player

Name of the Vulnerable Software and Affected Versions: HTML5 Video Player WordPress plugin versions prior to 2.5.27 Description: The issue concerns a failure to sanitize and escape a parameter from a REST route before using it in a SQL statement. This allows unauthenticated users to perform SQL...

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Description The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks PoC % time curl "https://example.com/?restroute=/h5vp/v1/video/1=1'+OR+SELECT+1+FROM+SELECTSLEEP5xyz--+-"...

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Description The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks % time curl "https://example.com/?restroute=/h5vp/v1/video/1&id=1'+OR+SELECT+1+FROM+SELECTSLEEP5xyz--+-"...

WordPress FV Flowplayer Video Player Plugin <= 7.5.45.7212 is vulnerable to Cross Site Scripting (XSS)

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.45.7212 Fixed in 7.5.46.7212 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35631 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 55cedf8dbca9 Credits Dimas...

PT-2024-40352 · Ez Systems · Ez Publish Legacy +1

Name of the Vulnerable Software and Affected Versions: VideoJS versions prior to the version that fixes the XSS vulnerability eZ Publish Platform 5.4 eZ Publish Legacy 5.4 Description: The issue is related to an XSS vulnerability in the Flash-based video player of VideoJS, which is bundled in...

CVE-2024-32078

CVE-2024-32078 involves the FV Flowplayer Video Player WordPress plugin. The issue is an authenticated open redirect in FV Flowplayer Video Player versions affected up to 7.5.44.7212, enabling an attacker with Contributor+ access to redirect users to an arbitrary site. The CVE entry notes a patch...

CVE-2024-32955 WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212...

CVE-2024-32955

CVE-2024-32955 is a Server-Side Request Forgery (SSRF) in FV Flowplayer Video Player for WordPress. Affected: FV Flowplayer Video Player plugin versions up to 7.5.43.7212. Impact and exploit details are not provided beyond SSRF. Refs indicate the issue is patched in the FV Flowplayer entry (Patch...

WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin FV Flowplayer Video Player versions = 7.5.43.7212...

WordPress FV Flowplayer Video Player Plugin <= 7.5.43.7212 is vulnerable to Server Side Request Forgery (SSRF)

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.43.7212 Fixed in 7.5.45.7212 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-32955 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID...

WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Flash Video Player versions = 5.0.4...

WordPress Flash Video Player Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Flash Video Player Type Plugin Vulnerable versions = 5.0.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32537 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 7ec38f6bbf4a Credits Dimas Maulana...

WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

Unvalidated Redirects and Forwards vulnerability discovered by Byeongjun Jo Patchstack Alliance in WordPress Plugin FV Flowplayer Video Player versions = 7.5.44.7212...

CVE-2024-2428

The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to...

CVE-2024-2428 The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSS

The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to...

CVE-2024-2428 The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSS

The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to...

WordPress Plugin The Ultimate Video Player 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

PT-2024-20337 · WordPress · The Ultimate Video Player

Name of the Vulnerable Software and Affected Versions: The Ultimate Video Player For WordPress versions prior to 2.2.3 Description: The issue is related to a lack of proper capability check when updating settings via a REST route, allowing users with Contributor and above roles to update them...

WordPress Plugin FV Flowplayer Video Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-19320 · Unknown · Fv Flowplayer Video Player

Name of the Vulnerable Software and Affected Versions: FV Flowplayer Video Player versions n/a through 7.5.41.7212 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Reflected XSS. Recommendations: For...