Description
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Remediation
References
Related Vulnerabilities
phpMyAdmin Other Vulnerability (CVE-2006-1678)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-6112)
WordPress Plugin wp-championship SQL Injection (5.8)
MySQL Incorrect Authorization Vulnerability (CVE-2025-50084)
WordPress Plugin Answer My Question Multiple Cross-Site Scripting Vulnerabilities (1.1)