Executive brief
WWBN AVideo is a video platform that includes a Live plugin for streaming functionality. The confirmLivePassword.php page contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious code into the password confirmation form. An attacker can craft a URL with JavaScript code that executes in victims' browsers when they click the link, potentially compromising user sessions and stealing sensitive data without requiring authentication.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the Live plugin's confirmLivePassword.php file. The root cause is that $_SERVER['REQUEST_URI'] is directly echoed into a form action attribute without HTML encoding. An attacker can break out of the attribute by injecting a double quote followed by an event handler (e.g., onmouseover). The vulnerability is network-accessible, requires no authentication, and requires minimal user interaction (simply hovering over the form). The scope is changed (executes in site origin), allowing attackers to perform actions as the authenticated user and access non-HttpOnly cookies. The fix involves applying htmlspecialchars() with ENT_QUOTES and UTF-8 encoding to all REQUEST_URI usages in HTML attributes. No patch is currently available.
Affected products
- WWBN AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed
- 2026-09-11: advisory