CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43296 – WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-43296
16 Aug 2024 — Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30. The Flash & HTML5 Video plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in versions up to, and including, 2.5.30. This makes it possible for authenticated attackers, with subscriber-level access and above, to update views, create thumb... • https://patchstack.com/database/vulnerability/html5-video-player/wordpress-html5-video-player-plugin-2-5-30-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43319 – WordPress HTML5 Video Player plugin <= 2.5.31 - Sensitive Data Exposure vulnerability
https://notcve.org/view.php?id=CVE-2024-43319
16 Aug 2024 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31. The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.31 via the h5vp_export_data() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract potentially sensitive inf... • https://patchstack.com/database/vulnerability/html5-video-player/wordpress-html5-video-player-plugin-2-5-31-sensitive-data-exposure-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 53%CPEs: 1EXPL: 5CVE-2024-5522 – HTML5 Video Player < 2.5.27 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2024-5522
30 May 2024 — The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks El complemento HTML5 Video Player de WordPress anterior a 2.5.27 no sanitiza ni escapa un parámetro de una ruta REST antes de usarlo en una declaración SQL, lo que permite a usuarios no autenticados realizar ataques de inyección SQL. The HTML5 Video Player – Best WordPress Video Player Plugin and B... • https://github.com/truonghuuphuc/CVE-2024-5522-Poc • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 75%CPEs: 1EXPL: 1CVE-2024-1061 – HTML5 Video Player <= 2.5.24 - Unauthenticated SQL Injection via id
https://notcve.org/view.php?id=CVE-2024-1061
30 Jan 2024 — The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function. El complemento de WordPress 'HTML5 Video Player', versión <2.5.25, se ve afectado por una vulnerabilidad de inyección SQL no autenticada en el parámetro 'id' de la función 'get_view'. The Html5 Video Player plugin for WordPress is vulnerable to SQL Injection via the 'id’ parameter in all versions up to, and including, 2.5.24 due to ins... • https://www.tenable.com/security/research/tra-2024-02 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 2%CPEs: 1EXPL: 1CVE-2023-6485 – Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-6485
08 Dec 2023 — The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins El complemento Html5 Video Player de WordPress anterior a 2.5.19 no sanitiza ni escapa a algunas de las configuraciones de su reproductor, lo que, combinado con la falta de comprobacio... • https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •