CVE-2022-3937

The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2022-3984

CVE-2022-3984 concerns the Flowplayer Video Player WordPress plugin, affected versions prior to 1.0.5. The root cause is failure to validate and escape certain shortcode attributes before output, enabling Stored XSS by users with as low as Contributor. The compromise vector is via crafted shortco...

CVE-2022-3984 Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS

The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-3984 Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS

The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2022-3937

CVE-2022-3937 affects the Easy Video Player WordPress plugin prior to 1.2.2.3. The root cause is insufficient sanitization/escaping of certain parameters, enabling a user with as low as Contributor to perform Cross-Site Scripting (XSS). The vulnerability can impact pages where the plugin processe...

CVE-2022-3937 Easy Video Player < 1.2.2.3 - Contributor+ Stored XSS

The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2022-3937 Easy Video Player < 1.2.2.3 - Contributor+ Stored XSS

The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

PT-2022-24936 · WordPress · Easy Video Player

Name of the Vulnerable Software and Affected Versions: Easy Video Player WordPress plugin versions prior to 1.2.2.3 Description: The issue allows users with a role as low as Contributor to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some parameters...

WordPress plugin Easy Video Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

The vulnerability of the VNC module of the Media Player VLC allows a hacker to execute arbitrary code on the target system.

The vulnerability of the VNC media player VLC is related to a boundary error during the playback of a malicious URL address within the VNC module. Exploiting this vulnerability allows an attacker to remotely trick the victim into opening a specially created stream, causing memory corruption and...

Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put, the following shortcode in a page/post flowplayer...

Easy Video Player < 1.2.2.3 - Contributor+ Stored XSS

The plugin does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. PoC 1. Add a new post and add the payload there: evpembedvideo url='" onerror=alert/XSS/ "' 2. Preview the post, and the XSS will trigger...

Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks As a contributor, put, the following shortcode in a page/post flowplayer src='...

WordPress Flowplayer Video Player plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress Flowplayer Video Player plugin versions = 1.0.4. Solution Update the WordPress Flowplayer Video Player plugin to the latest available version at least 1.0.5...

WordPress Easy Video Player plugin <= 1.2.2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress Easy Video Player plugin versions = 1.2.2.2. Solution Update the WordPress Easy Video Player plugin to the latest available version at least 1.2.2.3...

Easy Video Player < 1.2.2.3 - Contributor+ Stored XSS

The plugin does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. 1. Add a new post and add the payload there: evpembedvideo url='" onerror=alert/XSS/ "' 2. Preview the post, and the XSS will trigger...

Code injection

TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version...

CVE-2022-24902

CVE-2022-24902 affects TkVideoplayer prior to 2.0.0. Uncontrolled memory consumption can lead to performance degradation and, per some sources, potential DoS via memory allocation behavior. The issue has been patched in version 2.0.0 and later; upgrade to 2.0.0+ to remediate. Affected component: ...

The vulnerability of the __Parse_indx component in the VLC Media Player allows a attacker to access confidential data and also cause a service failure.

The vulnerability of the Parseindx component in the VLC Media Player lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to gain access to confidential data and also cause a service failure by using a specially created .avi file...

WordPress FV Flowplayer Video Player跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress FV Flowplayer Video Player 7.5.18.727 and previous versions have a cross-site scripting vulnerability tha...