CVE-2022-25229

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Popcorn Time	0.4.7

References

https://fluidattacks.com/advisories/bowie/Exploit, Third Party Advisory
https://github.com/popcorn-official/popcorn-desktop/issues/2491Exploit, Issue Tracking, Third Party Advisory
https://fluidattacks.com/advisories/bowie/Exploit, Third Party Advisory
https://github.com/popcorn-official/popcorn-desktop/issues/2491Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25236.1Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.CVE-2022-252307.8Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform CVE-2022-252317.5The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a speci CVE-2022-252347.8Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i CVE-2022-252359.8xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val CVE-2022-252369.8xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.CVE-2022-252379.8Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest CVE-2022-252385.4Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an CVE-2022-252418.8In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).CVE-2022-252428.8In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).CVE-2022-252436.5"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard cer CVE-2022-252446.5Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuratio