CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.
Explanation of Vulnerability in Simple Terms
tPlayer versions 1.2.1.6 and earlier contain a SQL injection vulnerability that allows unauthenticated attackers to query the database directly. An attacker can extract sensitive data including user credentials and site configuration. The vulnerability requires only network access and no user interaction. Scope is changed, meaning the impact may extend beyond the vulnerable component itself.
What an attacker can do
Extract sensitive data from the database, including user credentials and site configuration.
Potential impact on your site
Attackers can read all database contents without logging in, compromising user accounts and site secrets.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
