Executive brief
AVideo is a video streaming and management platform. An attacker with permission to upload videos can store malicious code in the trailer field that executes in the browser of anyone viewing the video gallery, including site administrators. This allows attackers to steal sessions, change settings, or deface the site.
Technical details
Stored XSS in the video trailer1 field rendered unsanitized in an inline onclick JavaScript attribute. The isValidURL() validator rejects literal quote and bracket characters but allows HTML entity sequences (e.g., '), which the browser decodes when parsing the attribute, breaking out of the JavaScript string. Any authenticated user with video upload permissions can inject a payload such as http://a/');alert(document.domain);// to execute arbitrary JavaScript in any visitor's session.
Affected products
- WWBN AVideo all versions through 29.1.1
Timeline
- 2026-09-26: disclosed
- 2026-09-11: other: vulnerability discovered and advisory prepared