WWBN AVideo CVE-2026-47694

The attacker must hold an authenticated AVideo account with permission to create or edit categories (CVSS PR:L). Exploitation is further gated by the requirement that a separate victim user visits the Gallery or affected category page after payload storage (CVSS UI:R). Deployments where category management is restricted exclusively to administrator-level accounts significantly limit the attacker pool. Platforms that permit regular content creators or moderators to manage categories face broader exposure. No special network position, software version on the victim side, or non-default server configuration is required beyond a running AVideo 29.0 or earlier instance accessible over the network.

The CVSS 5.4 Medium score is consistent with the realistic threat model: PR:L confirms the attacker must hold a valid account with category management privileges, and UI:R confirms exploitation requires a separate victim to browse the injected page - neither condition is trivially met in tightly administered deployments. However, the scope-changed indicator (S:C) elevates the rating above a purely self-affecting flaw, because the payload crosses user boundaries and can compromise any visitor to the gallery. No EPSS score was provided in the intelligence data, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. The primary real-world risk driver is the breadth of who holds category editing permissions: platforms that grant this right to regular content creators face substantially broader exposure than those restricting it to administrators. CVSS signals and description are fully consistent - no conflicts to flag.

An attacker registers or compromises a low-privilege AVideo account that has permission to create or edit categories, then saves a payload such as a JavaScript cookie-stealer or credential-harvesting redirect into a category description field. When any other authenticated user subsequently browses the Gallery view or navigates to the affected category page, the stored script executes in their browser session, exfiltrating their session token to an attacker-controlled endpoint and enabling account takeover without further attacker interaction.