EUVD-2026-75416
GHSA-6x7h-26ww-h8x2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any valid AVideo account
-
DeliveryLog in sending crafted User-Agent header
-
ExploitPayload stored unencoded in login history
-
ExecutionAdmin opens Login History page
-
PersistScript executes in admin session
-
ImpactAccount takeover / privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a valid AVideo login account of any privilege level (PR:L - not unauthenticated), (2) the target instance running the LoginControl plugin with login-history logging that records the User-Agent, and (3) an administrator subsequently viewing the Login History admin page (UI:P - passive user interaction by the victim admin). Exploitation is network-reachable with low complexity, but the dependency on an admin actually opening the Login History view and on the LoginControl plugin being enabled limits it from being fully automatic. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, 9.3) reflects a low-privilege, network-reachable stored XSS that crosses a security scope into the admin session, which is a realistic and meaningful threat for a multi-user video platform where 'any valid login account' is a low bar. The two moderating factors are PR:L (the attacker needs a working account, so it is not fully unauthenticated) and UI:P (an administrator must actually view the Login History page for the payload to fire), which make exploitation opportunistic rather than instantaneous; any operator running a shared AVideo instance should still treat admin-session script execution as urgent given the low skill and cost involved. There is no EPSS or KEV signal supplied and no POC referenced, so this is a genuine, well-characterized issue backed by a VulnCheck advisory and vendor GHSA rather than a high-CVSS-but-hollow finding, but predicted exploitation probability is unquantified from the available data. |
| Exploit ScenarioDerived | An attacker registers or uses any low-privilege AVideo account and logs in while sending a crafted User-Agent header containing a JavaScript payload (e.g. an <img onerror=...> or <script> construct). The header is stored in the login history, and when an administrator later opens the Login History page the payload executes in their authenticated session, enabling actions such as creating admin users, changing settings, or exfiltrating session data. No public POC is referenced in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
RemediationAI
Update AVideo to a build containing the fix committed after c3edcc274c389816d434acadac07ee78eaf330c1 as described in GHSA-wg67-62q3-2m33 (https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33); the input data does not name a tagged release version, so treat this as an upstream fix available (advisory/commit) whose released patched version is not independently confirmed and verify the exact build with the vendor. If immediate patching is not possible, compensating controls include disabling the LoginControl plugin (side effect: loss of login-history/audit functionality), placing a WAF or reverse-proxy rule to strip or sanitize anomalous User-Agent headers containing HTML/script metacharacters before they reach AVideo (side effect: may break legitimate clients with unusual UA strings), and restricting who can create accounts and hardening the admin panel with a strong Content-Security-Policy that blocks inline script (side effect: CSP tuning may break other admin UI features). These reduce but do not fully eliminate the stored-XSS exposure until the code fix is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo is a self-hosted open-source video streaming/CMS platform (CPE cpe:2.3:a:wwbn:avideo). The defect is CWE-79 (improper neutralization of input during web page generation) in the LoginControl plugin's login-history logging path: the client-supplied User-Agent HTTP request header is persisted to the login-history store and later rendered into the administrative Login History view without output encoding. Because the User-Agent is fully attacker-controlled and the tainted value is stored server-side and replayed to a different, higher-privileged user, this is a persistent (stored) XSS with a privilege-crossing sink rather than a reflected one.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Low-priv authenticated attacker (PR:L) stores a payload that fires only when an admin views the page (UI:R), crossing into the admin session (S:C) with high C/I impact and no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.
Technical POC Analysis
Stored cross-site scripting, CWE-79.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The WWBN AVideo LoginControl plugin (all versions) contains a stored cross-site scripting vulnerability that allows any authenticated user to inject malicious JavaScript via User-Agent headers, which executes with full administrative privileges when administrators view login history. This creates a direct privilege-escalation and account-takeover path from standard user to complete platform compromise. No public exploit code has been identified, but the vulnerability's ease of exploitation and administrative impact pose immediate organizational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable LoginControl plugin immediately; (2) enforce strict input validation and HTML entity encoding for all User-Agent storage and rendering; (3) restrict admin panel access to known IP addresses or VPN; (4) deploy Content Security Policy headers with restrictive script-src directives; (5) enable detailed audit logging and real-time alerting on administrative Login History page access; (6) deploy a Web Application Firewall (WAF) with XSS filter rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB