CVE-2026-72747
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Schwachstellenklasse
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Quellen
- https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593
- https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj
- https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unauthenticated-registration
- https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.