Executive brief
WWBN AVideo is a video streaming and management platform. The confirmLivePassword.php script contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary JavaScript in users' browsers by crafting a malicious link. An attacker can target any user—including administrators—to steal session cookies, modify site content, or perform actions on behalf of the victim.
Technical details
This is a reflected XSS vulnerability (CWE-79) in plugin/Live/confirmLivePassword.php. The vulnerable script directly interpolates the unauthenticated GET parameter 'u' into an <img src="..."> attribute without URL or HTML encoding. An attacker can inject a double-quote character in the 'u' parameter (along with a non-empty 'key' parameter and no valid 'c' parameter) to break out of the src attribute and inject an additional tag with an onerror handler. The vulnerability is network-accessible, requires no authentication, but does require user interaction (clicking a malicious link). No patched version was available at the time of disclosure.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed
- 2026-09-11: advisory