What is the CVSS score of EUVD-2026-17658?

EUVD-2026-17658 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-17658?

Yes, a patch is available for EUVD-2026-17658. Update the affected software to the latest version immediately.

PHP EUVD-2026-17658

| CVE-2026-34739 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 GitHub_M

GHSA-jqrj-chh6-8h78

PHP XSS

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17658

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:56 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. At time of publication, there are no publicly available patches.

AnalysisAI

Stored cross-site scripting (XSS) via unencoded HTML reflection in WWBN AVideo's User_Location plugin testIP.php endpoint allows authenticated attackers to execute arbitrary JavaScript in admin sessions. Affecting AVideo 26.0 and earlier, the vulnerability exploits SameSite=None cookie configuration to enable cross-origin exploitation, permitting unauthenticated attackers to lure admins to malicious links that hijack their authenticated context. No public exploit code or vendor patch has been released at time of analysis.

Technical ContextAI

The vulnerability exists in the User_Location plugin's testIP.php file, a PHP web application component handling user IP address testing. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting as reflected XSS without output encoding. The ip request parameter is directly inserted into an HTML input element without htmlspecialchars() or equivalent encoding functions. While the endpoint nominally restricts access to admin users, WWBN AVideo's misconfiguration of SameSite=None on session cookies eliminates the same-origin policy protection that would normally prevent cross-site request forgery and session hijacking. This allows JavaScript injection from attacker-controlled domains to execute within the admin's authenticated session context, bypassing browser security controls intended to isolate sensitive operations.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation: (1) upgrade WWBN AVideo to version 27.0 or later if available, verifying patch status at https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78; (2) disable or restrict access to the User_Location plugin's testIP.php endpoint via web server configuration (Apache/Nginx access control rules); (3) modify the SameSite cookie setting from None to Strict or Lax in AVideo's session configuration to restore same-origin policy protections-this requires access to configuration files typically located in config.php or equivalent; (4) implement Content-Security-Policy (CSP) headers to mitigate XSS payload execution; (5) review admin session activity for unauthorized script execution patterns. Organizations unable to patch should prioritize correcting the SameSite=None setting as the primary defense.