CVE-2013-2023
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component ...
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
- Record
CVE-2013-2023- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
- Record
CVE-2013-2023- Updated
- 2026-11-02
EUVDEUVD-2013-2011 No score
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
- Record
EUVD-2013-2011- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3mw-cwj5-rvgj No score
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component ...
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
- Record
GHSA-g3mw-cwj5-rvgj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2023 No score
Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
- Record
UBUNTU-CVE-2013-2023- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2023 is a medium vulnerability (CVSS 4.3) in Happyworm Jplayer, published August 15, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. No source names a fixed version.
References
github.com/happyworm/jPlayer/commit/8ccc429598d62eebe9f65a0a4e6fd406a123c8b4
marc.info?l=oss-security&m=136773622321563&w=2
openwall.com/lists/oss-security/2013/06/27/7
Show 9 moreShow less
jplayer.org/latest/release-notes
seclists.org/fulldisclosure/2013/Apr/192
nvd.nist.gov/vuln/detail/CVE-2013-2023
ubuntu.com/security/CVE-2013-2023
cve.org/CVERecord?id=CVE-2013-2023