Vulnerability · Published Jun 20, 2024 · Assigned by WPScan

CVE-2024-5522HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Medium 6.5

In plain English

A medium-severity security flaw in HTML5 Video Player from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Affected products (as reported)

Vendor	Product	Versions
Unknown	HTML5 Video Player	0 – before 2.5.27

References

https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/ exploit, vdb-entry, technical-description