EUVD-2026-75416
GHSA-6x7h-26ww-h8x2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-priv authenticated attacker (PR:L) stores a payload that fires only when an admin views the page (UI:R), crossing into the admin session (S:C) with high C/I impact and no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.
AnalysisAI
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a valid AVideo login account of any privilege level (PR:L - not unauthenticated), (2) the target instance running the LoginControl plugin with login-history logging that records the User-Agent, and (3) an administrator subsequently viewing the Login History admin page (UI:P - passive user interaction by the victim admin). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, 9.3) reflects a low-privilege, network-reachable stored XSS that crosses a security scope into the admin session, which is a realistic and meaningful threat for a multi-user video platform where 'any valid login account' is a low bar. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update AVideo to a build containing the fix committed after c3edcc274c389816d434acadac07ee78eaf330c1 as described in GHSA-wg67-62q3-2m33 (https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33); the input data does not name a tagged release version, so treat this as an upstream fix available (advisory/commit) whose released patched version is not independently confirmed and verify the exact build with the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable and remove the LoginControl plugin from all WWBN AVideo installations to eliminate attack exposure; verify removal by checking plugin directories and the AVideo admin console. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today