CVE-2021-23414

Cross-site Scripting (XSS)

Medium · published July 28, 2021

CVSS v3.1
6.5
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02549 · 84.9th percentile
Published
2021-07-28T07:20Z
EPSS history
Timeline
  • 28 JUL 07:20Z
    Cross-site Scripting (XSS)
    cvelistv5