CVE-2019-25086: XSS in Open Media Player 1.0-1.5

Successful exploitation of CVE-2019-25086 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious outcomes, including stealing session cookies, redirecting users to phishing sites, or injecting malicious content into the application's interface. The vulnerability's remote accessibility significantly broadens the attack surface, as it can be triggered without requiring prior authentication. The impact is amplified if the Open Media Player is integrated into a larger application, as the XSS vulnerability could be leveraged to compromise the entire system.

1. Reserved2022-12-27
2. Published2022-12-27
3. Modified2024-08-05
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-25086 is to upgrade Open Media Player to version 1.5.1 or later, which includes the fix (patch 3f39f2d68d11895929c04f7b49b97a734ae7cd1f). If upgrading is not immediately feasible, consider implementing input validation and sanitization on the ttmlurl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious requests targeting the timedtext.php file with unusual ttmlurl parameters.