CVE-2008-3567: Nullsoft Winamp

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Cross-zone scripting vulnerability in the NowPlaying functionality in NullSoft Winamp before 5.541 allows remote attackers to conduct cross-site scripting (XSS) attacks via an MP3 file with JavaScript in id3 tags.

Affected products

• Nullsoft Winamp: up to and including 5.54; version 2.0 only; version 2.4 only; version 2.5e only; version 2.6x only; version 2.7x only; …

Published 2008-08-10. Last modified 2026-06-16.