CVE-2025-13588Medium· 6.3▾ Sunlit

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 24, 2025

Updated

Oct 8, 2026

CVSS

6.3

Vendor

—

Product

—

CWE

CWE-918

Depth score

35 · Low

EPSS

0.25% · p15

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 318 days

Nov 24, 2025Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
0.2%

CWE-918 #nvd

Full technical detail▾

Overview

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Performing manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 2.8.1 is sufficient to resolve this issue. The patch is named c70bfb8d36b47bfd64c5ec73917e1d9ddb97af92. It is suggested to upgrade the affected component.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed