$ cve CVE-2006-4965 JSON

CVE-2006-4965 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 13.1% (pctl 96)

Patch early

A public exploit exists.

Description

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS	13.13% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2006-09-25
Last modified	2026-06-16

Affected (1)

Vendor	Product
apple	quicktime

Public exploits

Source	Title	Date
exploit-db	Apple QuickTime 7.1.3 PlugIn - Arbitrary Script Execution	2006-09-21

References

→ the Explorer · watch your stack · NVD