video-player vulnerabilities

2 known vulnerabilities in video-player from Haxtheweb. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  haxcms-nodejs: Improper Neutralization of Input During Web Page Generation

  CVE-2026-46496Jun 5, 2026Haxtheweb

  HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in

• 9.3 Critical severity

  haxcms-nodejs: Improper Neutralization of Input During Web Page Generation

  CVE-2026-46396Jun 5, 2026Haxtheweb

  HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src