CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-40926
https://notcve.org/view.php?id=CVE-2021-40926
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo demos/demo.mysqli.php en getID3 versiones 1.X y v2.0.0-beta, permiten a atacantes remotos inyectar scripts web o HTML arbitrarios por medio del parámetro showtagfiles • https://github.com/JamesHeinrich/getID3 https://github.com/JamesHeinrich/getID3/issues/341 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 0CVE-2014-2053 – WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness
https://notcve.org/view.php?id=CVE-2014-2053
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. getID3() anterior a 1.9.8, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, permite a atacantes remotos leer archivos arbitrarios, causar una denegación de servicio o posiblemente tener otro impacto a través de un ataque de entidad externa XML (XXE). • http://getid3.sourceforge.net/source/changelog.txt http://owncloud.org/about/security/advisories/oC-SA-2014-006 http://secunia.com/advisories/58002 http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2 • CWE-611: Improper Restriction of XML External Entity Reference •