CVE-2021-39350— FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-39350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting
Source: NVD (National Vulnerability Database)
Vulnerability Description
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress 插件 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 WordPress 插件 FV Flowplayer 视频播放器存在跨站脚本漏洞，该漏洞源于~/view/stats.php 文件中的 player_id 参数容易受到反射跨站点脚本攻击，该参数允许攻击者在 7.5.0.727 - 7.5.2.727 版本中注入任意 Web 脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FV Flowplayer Video Player | FV Flowplayer Video Player | 7.5.0.727 - 7.5.2.727 7.5.2.727 | - |
II. Public POCs for CVE-2021-39350
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts in versions 7.5.0.727 - 7.5.2.727. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39350.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-39350
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: FV Flowplayer Video Player
- CVE-2024-6338
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL I - CVE-2024-35631
WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - - CVE-2024-32078
WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redi - CVE-2024-32955
WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - - CVE-2024-22299
WordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2021-39350
No comments yet