Threats tagged 'ghsa-h9pq-8fc6-9cqw'

The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 contains a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows users with Contributor-level access or higher to supply a URL that the server fetches without proper validation. The response body of this fetch is stored and served publicly, enabling attackers to read internal resources if the response is returned with an image content type.