Read the docs

FolioVision

Records41All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9

Exploited now

FolioVision records in CISA KEV

No FolioVision vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Fv Flowplayer Video Player 13 records MEDIUM Foliopress Wysiwyg 1 record LOW Fv Wordpress Flowplayer Plugin 1 record LOW

Records

13 records in Fv Flowplayer Video Player · all components

TI-2024-05882 CVE-2024-6338 · GHSA-wgpq-79rc-3fgg

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

Priority MEDIUM 41

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplie…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00509 Published 2024-07-19 No fix listed CWE-89
TI-2021-16717 CVE-2021-39350 · GHSA-jfxr-v6vh-5957

FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting

Priority LOW 32

The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in ve…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02248 Published 2021-10-06 No fix listed CWE-79
TI-2018-00597 CVE-2018-0642 · GHSA-mv9w-m376-mf59

Cross-site scripting in FolioVision FV Flowplayer Video Player

Priority LOW 29

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01044 Published 2018-09-07 No fix listed CWE-79
TI-2023-04171 CVE-2023-4520 · GHSA-v3w9-6427-5g27

Cross-site scripting in FolioVision FV Flowplayer Video Player

Priority LOW 28

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00558 Published 2023-08-25 No fix listed CWE-79
TI-2020-18201 CVE-2020-35748 · GHSA-w9rf-wf6f-8c9r

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer…

Priority LOW 26

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00931 Published 2021-01-15 No fix listed CWE-79
TI-2022-09203 CVE-2022-25613 · GHSA-26h6-63w6-777w

Cross-site scripting in FolioVision FV Flowplayer Video Player

Priority LOW 25

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00571 Published 2022-04-04 No fix listed CWE-79
Open these records in search →