CVE-2003-0726

CVE-2003-0726 describes a vulnerability in RealOne Player, including RealOne Desktop Manager and RealOne Enterprise Desktop, that allows remote attackers to execute arbitrary scripts. This is achieved by crafting a SMIL presentation with a URL referencing a scripting protocol (e.g., "javascript:") within an area tag, which is then executed in the security context of a previously loaded URL. The vulnerability has a CVSS score of 5.1, indicating a medium severity with a network attack vector, high attack complexity, and potential for partial impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog or the Hot List, an ExploitDB entry (EDB-23043) confirms the existence of exploit code for RealOne Player versions 1.0, 2.0, 6.0.10, and 6.0.11. There is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.