Description

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T13:06:22.673Z",
  "pubdate": "2026-09-03T13:06:22.673Z",
  "executiveSummary": "AVideo through commit c91b5975d is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability located in the videoEmbeded.php file.\nThe vulnerability arises from insufficient input validation and output encoding when processing the 'link' parameter.\nAn unauthenticated remote attacker can exploit this flaw by crafting a malicious URL containing JavaScript payloads, which are then reflected within an HTML comment context.\nSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session.\nThis impact includes potential session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive information, or the redirection of victims to malicious domains.\nThe risk is categorized as high because it requires only a single click by an authenticated or unauthenticated user to execute, depending on the site's configuration.\nThis vulnerability highlights a critical failure in input handling for dynamic content rendering within embedded components.",
  "technicalDetails": "The root cause of this vulnerability is the insecure inclusion of user-supplied data within an HTML comment block in the videoEmbeded.php file.\nSpecifically, the application takes the 'link' parameter from the incoming HTTP request and echoes it directly into the HTML response without any form of sanitization, escaping, or validation.\nThe target location is within an HTML comment, which typically follows the structure <!-- [user_input] -->.\nAn attacker can break out of this comment block by injecting a closing sequence: -->.\nOnce the comment is terminated, the parser transitions back to standard HTML parsing mode, allowing the attacker to inject arbitrary HTML tags and scripts, such as <script>alert(document.domain)</script>.\nThe exploitation process follows a standard reflected XSS flow: 1) The attacker identifies the vulnerable 'link' parameter in the URL. 2) The attacker crafts a malicious URL containing the sequence '-->', followed by the malicious JavaScript payload. 3) The attacker distributes this URL to potential victims via phishing, social engineering, or public forums. 4) When a victim navigates to the crafted URL, the server reflects the payload into the response. 5) The victim's browser interprets the injected tags as legitimate executable code and executes the script within the origin of the AVideo application.\nBecause the payload is reflected, the exploitation does not require the attacker to have pre-existing access to the server or administrative privileges.\nThe vulnerability is exposed over the network via the web application interface and is reachable by any user capable of accessing the URL.\nThe scope of impact is limited to the client-side, but the lack of Content Security Policy (CSP) or output encoding makes the application highly vulnerable to various browser-based attacks.\nThe failure to treat the 'link' parameter as untrusted data allows for complete subversion of the intended page logic during the rendering of the embedded video component."
}