VULNERABILITY

CVE search

Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.

Severity

CritiqueÉlevéeMoyenneFaibleExploited in the wild (KEV)

Language / ecosystem

JavaScript / TypeScript (npm)Python (PyPI)PHP (Packagist)Java / Kotlin (Maven)GoRuby (RubyGems).NET (NuGet)

Stack

JavaScript / Node.js

Next.jsNuxtReactAngularSvelte / SvelteKitAstroRemixViteExpressNestJSFastifyNode.jsaxios

PHP

LaravelSymfonyPHP

Python

DjangoFlaskFastAPI / Starlette

Ruby

Ruby on Rails

Java

Spring

GinFiber

CMS

WordPressWooCommerceDrupalGhostStrapi

Servers & databases

nginxApache HTTP ServerMySQLPostgreSQLRedis

Vendor1

s3bubbleoracleibmgoogleadobemicrosoftmozillaciscoapacheappleredhatjenkinshpAll vendors →

s3bubble products

s3bubble-amazon-s3-audio-streaming 1s3bubble-amazon-s3-html-5-video-with-adverts 1s3bubble-amazon-web-services-oembed-media-streaming-support 1s3player 1

404 409 vulnerabilities · 1 768 actively exploited (CISA KEV)

s3bubble ✕Clear filters

4 results

ID	Severity	Summary	Published
CVE-2024-13865	MOYENNE6.1	The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.	15/05/2025
CVE-2024-13862	ÉLEVÉE7.1	The S3Bubble Media Streaming (AWS\|Elementor\|YouTube\|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	11/03/2025
CVE-2015-9463	ÉLEVÉE7.5	The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.