Html5 Mp3 Player With Playlist Vulnerabilities

[en] Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.

Affected:

up to 3.0.0

Fix:

No patched version reported

Disclosed:

Jan 8, 2024

CVE-2023-52207 on NVD →

The HTML5 MP3 Player with Playlist Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No POP chain is present i...

CVSS:

8.8

Affected:

up to 3.0.0

Fix:

No patched version reported

Disclosed:

Jan 3, 2024

CVE-2023-52207 on NVD →

[en] The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.

Affected:

up to 2.8.0

Fixed in:

2.8.0

Disclosed:

Dec 2, 2014

CVE-2014-9177 on NVD →

The HTML5 MP3 Player with Playlist Free plugin for WordPress is vulnerable to full path disclosure in versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to reveal sensitive full path information via sending a request to html5plus/playlist.php.

CVSS:

5.3

Affected:

up to 2.7.0

Fixed in:

2.8.0

Disclosed:

Nov 26, 2014

CVE-2014-9177 on NVD →