CVE-2026-100630

Published: Sep 26, 2026Modified: Oct 4, 2026

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/WWBN/AVideo/commit/40b3267760924389c626a549bb1c6fd013b3b29c

Source: disclosure@vulncheck.com

https://github.com/WWBN/AVideo/security/advisories/GHSA-v7vx-v9q9-qhw3

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/avideo-stored-xss-via-html-entity-bypass-in-trailer1-field

Source: disclosure@vulncheck.com

https://github.com/WWBN/AVideo/security/advisories/GHSA-v7vx-v9q9-qhw3

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.