CVE-2025-69771

critical · 9.6

Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the same-site context, it can bypass cross-origin restrictions, leading to unauthorized same-site API requests and session data exfiltration.

9.6

CVSS

0.3%

EPSS (exploit prob.)

26th

EPSS percentile

2026-02-25

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
killergerbah	asbplayer	<= 1.13.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/killergerbah/asbplayer
https://reve-offensive.tistory.com/35

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-69771