CVE-2003-0726
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via...
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
Exploit likelihood
What each source reports
NVD Score used
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
- Record
CVE-2003-0726- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
- Record
CVE-2003-0726- Updated
- 2026-11-02
EUVDEUVD-2003-0717 No score
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
- Record
EUVD-2003-0717- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5cf7-xj2f-mmwx No score
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via...
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
- Record
GHSA-5cf7-xj2f-mmwx- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | RealOne Player 1.0/2.0/6.0.10/6.0.11 - '.SMIL' File Script Execution | 2003-08-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0726 is a medium vulnerability (CVSS 5.1) in Realnetworks Realone Player, published September 3, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.83%, the 94th percentile. No source names a fixed version.
References
securityfocus.com/bid/8453
digitalpranksters.com/advisories/realnetworks/smilscriptprotocol.html
exchange.xforce.ibmcloud.com/vulnerabilities/13028
service.real.com/help/faq/security/securityupdate_august2003.html
securitytracker.com/id?1007532
nvd.nist.gov/vuln/detail/CVE-2003-0726
github.com/advisories/GHSA-5cf7-xj2f-mmwx