Description (CNA)
WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected < 26.0 |
CWE
CWE-79
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv
- https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833
ADP enrichment
No English description supplied.