CVE-2026-13125
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
02/07/2026
Última modificación:
02/07/2026
Descripción
*** Pendiente de traducción *** GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.<br />
<br />
In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it&#39;s possible to call a combination of the `create` method and `getScreenCapture` to retrieve the content of the user&#39;s screen.
Impacto
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA