CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page

published May 20, 2022

CVSS
—
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Published
2022-05-20T11:01Z
EPSS history
Timeline
  • 20 MAY 11:01Z
    Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page
    cvelistv5