Executive brief
AVideo is a video hosting and streaming platform. The videoEmbeded.php page, used to embed videos on other websites, contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can craft a malicious embed URL that executes arbitrary JavaScript in the victim's browser when the page is visited, potentially stealing session data, performing phishing attacks, or compromising the integrity of any website that embeds the video.
Technical details
The vulnerability is a reflected cross-site scripting (CWE-79) flaw in videoEmbeded.php line 469, which echoes the user-controlled $_GET['link'] parameter inside an HTML comment with zero escaping. An attacker can close the HTML comment with --> and inject arbitrary JavaScript code. The affected page is public (no authentication required), is designed for iframe embedding, and requires only that a valid link-type or liveLink-type video exists on the target site with a known videos_id. The proof-of-concept demonstrates the bypass: a payload like --><script>alert(1)</script><!-- closes the comment and executes script tags. The recommended fix is to apply htmlspecialchars($_GET['link'], ENT_QUOTES|ENT_HTML5) before output, which neutralizes the comment breakout. No patch is currently available (patched versions listed as "None").
Affected products
- WWBN AVideo through commit c91b5975d
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory published
- 2026-09-03: advisory: CVE-2026-85158 published on NVD