What is the CVSS score of EUVD-2026-16752?

EUVD-2026-16752 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16752?

WWBN AVideo instances up to version 26.0 contain a reflected cross-site scripting vulnerability that allows attackers to steal authenticated user credentials through maliciously crafted URLs.

How to fix or mitigate EUVD-2026-16752?

Within 24 hours: Identify all WWBN AVideo deployments and confirm current version against version 26.0 baseline; restrict external access to AVideo administrative interfaces where feasible. Within 7 days: Implement WAF rules to block requests containing JavaScript payloads in request parameters destined for AVideo; conduct user awareness briefing on phishing URLs targeting AVideo login flows. Within 30 days: Monitor vendor advisory channels for patch availability; evaluate upgrade timeline to patched version once released; consider temporary feature restriction or segmentation of AVideo from high-value systems if patch remains unavailable.

PHP EUVD-2026-16752

| CVE-2026-34375 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 GitHub_M

GHSA-pm37-62g7-p768

XSS PHP

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 19:00 euvd

EUVD-2026-16752

Analysis Generated

Mar 27, 2026 - 19:00 vuln.today

CVE Published

Mar 27, 2026 - 18:17 nvd

HIGH 8.2

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the $_REQUEST['plugin'] parameter into a JavaScript block without any encoding or sanitization. The plugin parameter is not included in any of the framework's input filter lists defined in security.php, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via User::getUserName() and User::getUserPass(), meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.

AnalysisAI

Reflected cross-site scripting (XSS) in WWBN AVideo versions up to 26.0 enables credential theft through unsanitized request parameter echoed into JavaScript context. Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript and exfiltrate the victim's username and password hash directly exposed in the vulnerable code block. CVSS score of 8.2 reflects high confidentiality impact; no public exploit identified at time of analysis.

Technical ContextAI

WWBN AVideo is an open-source video streaming platform written in PHP. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in the YPTWallet Stripe payment confirmation page where the plugin parameter from $_REQUEST is directly output into a JavaScript block without encoding or sanitization. The affected codebase (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) fails to include the plugin parameter in the framework's input filter lists defined in security.php, allowing raw user input to reach the DOM. This reflected XSS is particularly severe because the same script block contains User::getUserName() and User::getUserPass() function calls that expose the authenticated user's credentials directly in the JavaScript context, making credential exfiltration trivial upon successful exploitation.

RemediationAI

Upstream fix available via commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 which addresses the unsanitized output issue (see https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2). Administrators should update to a version incorporating this commit or apply the patch manually by implementing proper output encoding for the plugin parameter and removing credential exposure from the JavaScript context. Until patching is completed, consider disabling the YPTWallet Stripe payment module if not operationally required, implementing web application firewall rules to detect and block JavaScript injection attempts in the plugin parameter, and monitoring for suspicious payment page access patterns. Consult the GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768 for additional vendor guidance.