Avideo EUVD-2026-17634

CVSS score of 6.1 reflects moderate severity with network-exploitable attack vector, low complexity, no privilege requirement, but requiring user interaction (UI:R) and scoped to confidentiality and integrity impacts only. The EPSS data is not provided, limiting probabilistic exploitation assessment. The critical risk signal is the CSRF+XSS chaining potential: an unauthenticated attacker can craft a malicious CSRF payload targeting admin/save.json.php to inject JavaScript into plugin configs, which then executes when administrators visit the affected page-creating a reliable attack path without requiring initial compromise. However, the requirement for user interaction (administrator visiting the page) and the scoped impact reduce immediate risk compared to uninteracted RCE vulnerabilities. No KEV (CISA Known Exploited Vulnerabilities) status is provided, and no public POC is confirmed as available at time of publication per the description. This is a real priority for AVideo deployments due to the admin-targeting nature and ease of exploitation via CSRF, despite the moderate CVSS score.

An attacker crafts a malicious CSRF payload (HTML form or JavaScript) that targets an administrator's browser and sends a POST request to admin/save.json.php with a plugin configuration parameter containing embedded JavaScript (e.g., an img tag with onerror handler or script tag). If the administrator has an active session and visits the malicious link, the CSRF causes the configuration to be saved with the malicious payload. Subsequently, when any administrator navigates to the plugin configuration page to manage settings, the jsonToFormElements() function renders the unencoded payload directly into the HTML form, triggering the JavaScript execution in that administrator's browser. The attacker can steal session cookies, perform admin actions, or escalate privileges.