CVE-2019-9766

CVE-2019-9766 استغلال ثغرة تجاوز سعة المخزن المؤقت في Free MP3 CD Ripper الإصدار 2.6، عن طريق إنشاء ملف MP3 خاص، وعند تشغيله بواسطة المشغل، يقوم ملف الصوت الطعم باستغلال الثغرة لتنفيذ تعليمات برمجية عشوائية. إعادة الإنتاج آلة الهجوم: kali201903 192.168.198.142 الجهاز الضحية: windows10 21H1...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading. A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion. This...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 إثبات مفهوم لحذف الملفات التعسفي ★ الوصف CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p مثال python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...

CVE-2019-9766

CVE-2019-9766 سأبذل قصارى جهدي حول CVE Free MP3 CD Ripper إنه محوّل بين ملفات .mp3 وأنواع ملفات أخرى تحويل ملف. الخطأ وفقًا لـ NVD، نجد أنه في vision 2.6 يوجد تجاوز سعة في المخزن المؤقت قائم على المكدس Stack-based Buffer Overflow في منطقة المخزن المؤقت. لذا يمكننا إنشاء PoC له. يتم تغيير نوع المل...

CVE-2026-104673

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2026-104673 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

EUVD-2026-92318

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2026-104673

The Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (versions n/a through 5.14.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability could allow an attacker to execut...

CVE-2026-104673 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.14.2...

PT-2026-104768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2026-104673: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

EUVD-2014-9822

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130: Improper Limitation of a Pathname to a Restricted Directory

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

VulnCheck KEV: CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...