Cross-site Scripting (XSS)

Paella Player is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of closed-caption cue text, which allows an attacker to inject malicious script content through captions and execute it in a victim's browser...

Cross-site Scripting (XSS)

Overview @asicupv/paella-core is a Multi stream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into close...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions. Details Cross-site scripting or XSS is a code...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615

Paella Player , a set of libraries for building multi-stream video players, contains a stored XSS vulnerability via closed captions cue text . The flaw is exploitable when a user views maliciously crafted caption data, with an impact spanning confidentiality and integrity in a changed scope (CVSS...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...