CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background universal-video-player-and-bg allows Blind SQL Injection.This issue affects Video Player & FullScreen Video Background: from n/a through <= 2.4.1.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability exists in Video Player & FullScreen Video Background versions up to 2.4.1. An authenticated administrator can inject malicious SQL commands through unfiltered input, potentially reading sensitive database information. The vulnerability requires high-level privileges and does not affect data integrity, but can cause partial service disruption.
What an attacker can do
Read sensitive data from the site's database, such as user credentials or configuration details.
Potential impact on your site
An admin account compromise could expose your database contents; update the plugin immediately.
Conditions required to exploit
Attacker must have administrator-level access to the site.
Key dates
External resources
Related vulnerabilities
