CVE-2026-77615— Paella Player: Stored XSS via caption cue text
Quick assessment
Affected
opencast opencast
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Paella Player 是一套用于创建多流视频播放器的库。在 Paella Player 2.12.11 之前（该版本也被 Opencast 19.7 和 20.2 之前的版本所使用），存在通过字幕（closed captions）的提示文本（cue text）发起潜在跨站脚本（XSS）攻击的漏洞。此漏洞已在 2.12.11 版本中得到修复。
Possible ATT&CK Techniques 3 AI
T1189 · Drive-by Compromise T1083 · File and Directory Discovery T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77615
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Paella Player: Stored XSS via caption cue text
Source: CVE Program / CVE List V5
Vulnerability Description
Paella Player is a set of libraries to create a multi stream video player. Prior to Paulla Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| opencast | opencast | < 19.7 | - |
|
| polimediaupv | paella-player | < 2.12.11 | - |
|
II. Public POCs for CVE-2026-77615
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77615
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77615 (5)
Vendor Pages for CVE-2026-77615 (3)
-
🔗 Release Opencast 19.7 · opencast/opencast · GitHub x_refsource_MISC
-
🔗 Release Opencast 20.2 · opencast/opencast · GitHub x_refsource_MISC
-
IV. Related Vulnerabilities
Same product: opencast
-
CVE-2026-77614
Opencast: Session fixation in login enables account takeover -
CVE-2025-61906
Opencast's editor accidentally publishes videos/overwrites p -
CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting -
CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI co -
CVE-2025-54380
Opencast still publishes global system account credentials
Same vendor: opencast
-
CVE-2026-77614
Opencast: Session fixation in login enables account takeover -
CVE-2025-61906
Opencast's editor accidentally publishes videos/overwrites p -
CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting -
CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI co -
CVE-2025-54380
Opencast still publishes global system account credentials
Same weakness: CWE-79
-
CVE-2026-2585
Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+ -
CVE-2026-93454
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note -
CVE-2026-83946
Azure Portal Spoofing Vulnerability -
CVE-2026-54645
CubeCart: Stored XSS in Product Description Editor via Globa -
CVE-2026-54644
CubeCart: XSS via Anchor Tag Attribute Injection in gui.clas
V. Comments for CVE-2026-77615
No comments yet