WWBN AVideo CVE-2026-89240

The Live plugin must be installed and plugin/Live/confirmLivePassword.php must be publicly reachable. The attacker's crafted request must supply a non-empty key GET parameter and omit a valid c parameter to reach the vulnerable code path that renders u into the img src attribute. The u parameter is explicitly not covered by the application's $securityFilter, making it an unguarded injection point regardless of global filter settings. No attacker authentication is required (PR:N confirmed by CVSS vector). Victim interaction is mandatory - the target must open the crafted link in a JavaScript-enabled browser. Impact is scoped to the AVideo web origin; exploitation does not traverse to other origins.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, score 5.3) correctly captures the key constraints: network-accessible with no complexity, no privilege required, but dependent on victim interaction (UI:P). Confidentiality and integrity impact are rated low at the vulnerable-system level, with slight subsequent-system spillover. The moderate score understates the practical risk if an administrator is targeted, since JavaScript execution under the AVideo origin could steal admin session cookies or silently trigger privileged in-application actions - effectively turning a low-impact XSS into an indirect privilege escalation vector. EPSS data was not provided in the input, so exploitation probability cannot be quantified; the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The mechanism is trivially reproducible by anyone with basic XSS knowledge, which warrants urgency despite the score - even a mid-sized municipal IT team in gdynia running AVideo for internal video hosting should treat this as a high-priority remediation item if the platform is internet-facing and the Live plugin is active. The absence of a patch at disclosure time means there is no low-effort fix.

An attacker constructs a URL to the AVideo Live password confirmation page containing a double-quote character in the u parameter, a non-empty key value, and no valid c parameter, then delivers it to an administrator via a phishing email or embedded link on an attacker-controlled site. When the administrator opens the URL, their browser renders the unsanitized u value inside the img tag, triggering the injected onerror handler and executing attacker-controlled JavaScript under the AVideo origin, where it can exfiltrate the admin session cookie or forge in-application requests.