Description (CNA)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected <= 26.0 |
CWE
CWE-79
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
- https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8
ADP enrichment
No English description supplied.