CVE-2022-32271

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary local files.

• CWE-79

• https://github.com/Edubr2020/RP_DCP_Code_ExecExploit, Third Party Advisory
• https://youtu.be/AMODp3iTnqYExploit, Third Party Advisory
• https://github.com/Edubr2020/RP_DCP_Code_ExecExploit, Third Party Advisory
• https://youtu.be/AMODp3iTnqYExploit, Third Party Advisory

Published

Jun 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32265qDecoder before 12.1.0 does not ensure that the percent char…5.3
• CVE-2022-32266DMA attacks on the parameter buffer used by a software SMI h…6.4
• CVE-2022-32267DMA transactions which are targeted at input buffers used fo…6.4
• CVE-2022-32268StarWind SAN and NAS v0.2 build 1914 allow remote code execu…8.8
• CVE-2022-32269In Real Player 20.0.8.310, the G2 Control allows injection o…9.8
• CVE-2022-32270In Real Player 20.0.7.309 and 20.0.8.310, external::Import()…9.8
• CVE-2022-32272OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP bef…9.8
• CVE-2022-32273As a result of an observable discrepancy in returned message…4.3
• CVE-2022-32274The Transition Scheduler add-on 6.5.0 for Atlassian Jira is …5.4
• CVE-2022-32275Grafana 8.4.3 allows reading files via (for example) a /dash…7.5
• CVE-2022-32276Grafana 8.4.3 allows unauthenticated access via (for example…7.5
• CVE-2022-32277Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Ob…5.3