AVideo CVE-2026-88869

Exploitation requires the AD_Server plugin to be enabled and its log.php endpoint reachable by the attacker; the injection itself needs no authentication (PR:N). The payload only executes when an administrator subsequently views the Ad Types report (UI:P/UI:R) - this admin-view requirement is the primary limiting factor, meaning the attack is not fully automatic and depends on a privileged user visiting the affected report. The rendering sink is jQuery .html() in the admin report, so the flaw is only exploitable in AVideo builds at or before commit c3edcc274c389816d434acadac07ee78eaf330c1 that ship the vulnerable AD_Server code path.

The CVSS 4.0 base score of 9.3 reflects a network vector, low complexity, no privileges required, and only passive/required user interaction (UI:P) - an administrator merely viewing the ad report triggers execution. The high vulnerable-system and subsequent-system impact metrics (VC:H/VI:H/SC:H/SI:H) capture that the executing JavaScript runs with the admin's authority, potentially compromising the management interface. Real-world priority is tempered by the interaction requirement: an admin must open the Ad Types report for the payload to fire, and exploitation depends on the AD_Server plugin being enabled and reachable. No EPSS score, KEV listing, or public POC is present in the provided data, so this is not confirmed as widely or actively exploited; the primary corroboration is the vendor GHSA and the VulnCheck advisory. Overall a credible high-severity issue for exposed AVideo instances running the AD_Server plugin, but not evidence of mass exploitation.

An unauthenticated attacker sends a crafted request to the AD_Server plugin's log.php with a 'label' parameter containing a malicious script payload, which AVideo stores without escaping. When an administrator later opens the Ad Types report, jQuery .html() renders the payload and executes the attacker's JavaScript in the admin's authenticated session, allowing session/cookie theft or actions performed as the administrator. No public POC is identified, but the low-complexity network vector makes the injection step trivial.