Executive brief
AVideo is a self-hosted video platform with wallet functionality for managing user funds and cryptocurrency payments. The YPTWallet plugin contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into wallet withdrawal logs. When administrators review pending withdrawal requests, the attacker's script executes in their session, enabling unauthorized administrative actions such as account takeover or system compromise.
Technical details
This is a stored XSS vulnerability (CWE-79) in the AVideo YPTWallet plugin affecting versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. An authenticated user with wallet balance can POST malicious CryptoWallet values to saveConfiguration.php, which base64-encodes but does not HTML-escape the input. When a manual withdrawal is initiated, manualWithdrawFunds.json.php base64-decodes and concatenates the attacker's payload directly into an HTML email message stored in wallet_log.information without sanitization. Administrators viewing pendingRequests.php are vulnerable, as the bootgrid renderer returns the information column as raw HTML, executing the payload in the admin's origin. An attacker needs a valid account with withdrawal capability (balance and transfer permissions). The vulnerability persists until the log entry is deleted, and can be exploited to perform same-origin fetch requests for administrative actions. No patch was available at time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: advisory
- 2026-09-11: disclosed