VULNERABILITY INTELLIGENCE

CVE-2022-25229

CVSS score5.4 MEDIUM

EPSS probability0.57%

CISA KEVNot currently listed

Published2022-05-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Weakness classification

nvd@nist.gov: CWE-79

Primary references

help@fluidattacks.com — Exploit, Third Party Advisory
help@fluidattacks.com — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory