VULNERABILITY INTELLIGENCE
CVE-2010-4396
CVSS score4.3 MEDIUM
EPSS probability1.14%
CISA KEVNot currently listed
Published2010-12-14
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Description
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.
Weakness classification
- CWE-20: Improper Input Validation