Video Player
Approved changes feed: RSS · Atom
cpe:2.3:a:haxtheweb:video-player:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Haxtheweb (0de9840f-d837-5e08-a211-1a6ecda766ab) |
|---|---|
| Product | Video Player (efea21ac-1265-539c-99c3-dc221f190361) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46496 |
vulnerable | 2026-06-08 08:05:12.089329 |
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.
Published: 2026-06-05T18:46:36.822Z
Updated: 2026-06-05T19:10:41.697Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-46396 |
vulnerable | 2026-06-08 08:05:12.069192 |
HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
Published: 2026-06-05T18:44:28.997Z
Updated: 2026-06-09T14:36:27.436Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.