getid3 vulnerabilities

Products

• getid3 2

Latest getid3 CVEs

Newest publication first

1. CVE-2021-40926 Cross-site scripting in demos/demo.mysqli.php in getID3

   Published 2021-10-01

   Medium·CVSS 6.1 EPSS 1.0%

   Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.

2. CVE-2014-2053 getID3 is vulnerable to XML External Entity (XXE)

   Published 2014-06-04

   High·CVSS 7.5 EPSS 4.7% PoC

   getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.