CVE-2026-72747

Published: Aug 11, 2026Modified: Sep 8, 2026Deferred

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593

Source: disclosure@vulncheck.com

https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unauthenticated-registration

Source: disclosure@vulncheck.com

https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.