CVE-2024-1061

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1061
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the  'get_view' function.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.tenable.com/security/research/tra-2024-02 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
History

05 Feb 2024, 18:21

Type Values Removed Values Added
First Time Bplugins
Bplugins html5 Video Player
References () https://www.tenable.com/security/research/tra-2024-02 - () https://www.tenable.com/security/research/tra-2024-02 - Exploit, Third Party Advisory
CPE cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : 8.6 		v2 : unknown
v3 : 9.8

30 Jan 2024, 14:18

Type Values Removed Values Added
Summary
  • (es) El complemento de WordPress 'HTML5 Video Player', versión &lt;2.5.25, se ve afectado por una vulnerabilidad de inyección SQL no autenticada en el parámetro 'id' de la función 'get_view'.

30 Jan 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-30 09:15

Updated : 2024-02-05 18:21

NVD link : CVE-2024-1061

Mitre link : CVE-2024-1061

CVE.ORG link : CVE-2024-1061

JSON object : View

Products Affected

bplugins

  • html5_video_player
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')