CVE-2019-13573

moderate-risk
Published 2019-07-17

A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.

Do I need to act?

~
4.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Fv Flowplayer Video Player

Affected Vendors

Foliovision

References (8)

Third Party Advisory https://fortiguard.com/zeroday/FG-VD-19-097
Patch https://plugins.trac.wordpress.org/changeset/2121566/fv-wordpress-flowplayer/tru...
Release Notes https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
Third Party Advisory https://wpvulndb.com/vulnerabilities/9451
Third Party Advisory https://fortiguard.com/zeroday/FG-VD-19-097
Patch https://plugins.trac.wordpress.org/changeset/2121566/fv-wordpress-flowplayer/tru...
Release Notes https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
Third Party Advisory https://wpvulndb.com/vulnerabilities/9451
45
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 8/34 · Low
Exposure 5/34 · Minimal