What is the CVSS score of EUVD-2026-17634?

EUVD-2026-17634 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP EUVD-2026-17634

| CVE-2026-34396 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 GitHub_M

GHSA-v4h7-3x43-qqw4

XSS PHP CSRF

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17634

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:40 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars() or any other output encoding. The jsonToFormElements() function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input attributes. An attacker who can set a plugin configuration value (either as a compromised admin or by chaining with CSRF on admin/save.json.php) can inject arbitrary JavaScript that executes whenever any administrator visits the plugin configuration page. At time of publication, there are no publicly available patches.

AnalysisAI

Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows unauthenticated attackers to inject malicious JavaScript into plugin configuration values via CSRF, or authenticated admins to directly inject code that executes in administrator browsers when accessing plugin configuration pages. The vulnerability exploits missing output encoding in the jsonToFormElements() function, enabling arbitrary JavaScript execution within the admin panel with impact to confidentiality and integrity.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform that manages plugin configurations through the admin/functions.php file. The jsonToFormElements() function directly interpolates configuration values into HTML form elements (textarea, option, input attributes) without applying htmlspecialchars() or other output encoding mechanisms. This violates fundamental XSS prevention principles for reflected and stored XSS contexts. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a critical class covering output encoding failures. An attacker can chain this with CSRF attacks on admin/save.json.php to modify plugin configuration without direct admin credentials, or directly modify configurations if they have compromised administrative access.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running WWBN AVideo 26.0 or earlier must either apply patches when released by WWBN or implement immediate compensating controls. Workarounds include restricting access to the admin panel (admin/save.json.php and plugin configuration pages) to trusted IP ranges, implementing CSRF tokens on admin/save.json.php if not already present, and enforcing Content Security Policy (CSP) headers to restrict inline script execution. Monitor the official GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4 for patch release announcements and apply immediately when available. Input validation on plugin configuration values and output encoding of all configuration values displayed in HTML contexts should be prioritized in patched versions.