Unscored severity · published Mar 24, 2014
CVE-2013-7343
Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FH
Flowplayer Html5 · Flowplayer
5.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7343
Exploit
https://github.com/flowplayer/flowplayer/commit/27e8f178276c185cbddb4f14c91d4ce7b3865db1
github.com
https://github.com/flowplayer/flowplayer/issues/381
More from Flowplayer Html5
–
CVE-2013-7342
Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML…