EUVD-2026-56137
GHSA-mg62-j9w6-5hfh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Registration is open to unauthenticated users (PR:N); admin must visit the management page (UI:R); payload executes across scope in the admin browser (S:C).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
AnalysisAI
Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.
Technical ContextAI
AVideo is an open-source, self-hosted video platform developed by WWBN (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), written primarily in PHP. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), arising from two distinct failures confirmed in the patch commit. First, the setPhone() method in objects/user.php stored the raw phone value directly to the database without applying strip_tags(), unlike the setName() method which already had this protection. Second, the admin users grid in objects/users.json.php rendered phone values by pulling raw database rows directly - bypassing the sanitizing User::getPhone() getter - and passing them to the bootgrid component which renders cell values via innerHTML. This dual failure, unsanitized write path and unsafe render path, formed a complete stored XSS chain requiring no special privilege to initiate.
RemediationAI
Apply the upstream fix commit 1adcb75458a3b31058655698a833e8cbde4d0593 from the WWBN/AVideo repository (https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593), which patches two locations: strip_tags() added to setPhone() in objects/user.php, and a defense-in-depth sanitization pass added in objects/users.json.php to neutralize markup in rows written before the setter was hardened. Upstream fix is available via commit; a released tagged version is not independently confirmed from available data - verify with the GHSA-cfvq-r985-84wj advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj. As a compensating control prior to patching, disable public user registration if it is not operationally required - this eliminates the unauthenticated injection vector entirely, though it prevents new self-service account creation. Alternatively, deploy a WAF rule blocking HTML tags and script content in the phone registration parameter; note this may produce false positives for phone values containing angle brackets in some locales. For already-deployed instances, the patch's defense-in-depth layer in the grid renderer will sanitize previously stored malicious values on rendering.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today