Description

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-30T15:16:45.013Z",
  "pubdate": "2026-08-30T15:16:45.013Z",
  "executiveSummary": "WWBN AVideo is susceptible to an unauthenticated reflected cross-site scripting (XSS) vulnerability located within the url2Embed.json.php endpoint. This security flaw stems from improper sanitization of user-supplied input provided through URL parameters.\nBy injecting HTML metacharacters into the endpoint, an unauthenticated attacker can force the execution of arbitrary JavaScript within the context of a victim's active session. The impact of this vulnerability is significant, as it enables session hijacking, the theft of sensitive session cookies, and the unauthorized capture of anti-CSRF tokens.\nThe attack is facilitated by crafting an encrypted evideo payload that incorporates unescaped markup. When this payload is delivered via a legitimate-looking link pointing to the host domain, the application processes the malicious script, executing it in the user's browser. Because the vulnerability is reflected and does not require authentication, it poses a severe threat to any user interacting with the platform. Organizations utilizing affected versions of AVideo should prioritize remediation to prevent credential harvesting and unauthorized actions performed on behalf of legitimate users.",
  "technicalDetails": "The vulnerability resides in the url2Embed.json.php script, which fails to adequately sanitize input parameters before reflecting them back to the user's browser. The root cause is the improper handling of HTML metacharacters, allowing for the injection of executable JavaScript code within the response generated by the application.\nThe exploitation flow begins with the attacker crafting a malicious URL containing an encrypted evideo payload. This payload is specifically structured to contain unescaped HTML and script tags. The attacker then distributes this URL to a victim, enticing them to interact with the link. Because the link originates from the legitimate domain of the WWBN AVideo installation, it may bypass common user scrutiny.\nWhen the victim navigates to the crafted URL, the server-side logic in url2Embed.json.php processes the request and embeds the attacker-supplied, unescaped payload into the response document. The browser, receiving the malformed content, treats the injected JavaScript as legitimate code originating from the trusted domain. This triggers the execution of the payload within the security context of the victim's session.\nSuccessful exploitation grants the attacker the ability to execute arbitrary scripts, facilitating post-exploitation activities such as document object model (DOM) manipulation, session token theft, and the extraction of sensitive data like anti-CSRF tokens. Since the script executes within the origin of the AVideo domain, it bypasses Same-Origin Policy (SOP) restrictions, allowing for full interaction with the site's cookies and local storage accessible to the user session. The attack requires no authentication or special privileges, making it accessible to any remote, unauthenticated adversary capable of delivering the malicious link to a user. The vulnerability is entirely network-exposed, provided the endpoint is reachable over the web."
}