Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-11T12:16:53.960Z",
  "pubdate": "2026-09-11T12:16:53.960Z",
  "executiveSummary": "WWBN AVideo contains a stored cross-site scripting (XSS) vulnerability located in the UserGroups::setGroup_name() function, affecting versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability arises from the application's failure to perform adequate input sanitization on the 'group_name' parameter before storing it in the database.\nAn authenticated administrator with 'canAdminUserGroups' permissions can inject arbitrary malicious HTML and JavaScript payloads into the system.\nWhen other administrative users access the affected user manager interface, the stored malicious scripts execute within their browser session.\nThis vulnerability poses a significant risk to the administrative environment, potentially allowing for session hijacking, unauthorized account actions, or the bypass of administrative controls.\nExploitation requires the attacker to possess elevated administrative privileges and targets the integrity and security of the administrative management console.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and output encoding within the UserGroups::setGroup_name() method in AVideo. The application fails to sanitize or neutralize executable content within the 'group_name' field, allowing unsanitized user-supplied strings to be persisted directly into the backend database.\nBecause the application does not implement context-aware output encoding when rendering these values in the user manager interface, any stored payload is treated as trusted HTML by the administrator's browser. This results in the execution of injected script tags, event handlers (such as 'onerror' or 'onmouseover'), or other malicious DOM-based payloads.\nThe attack flow begins with an authenticated administrator who has been granted the 'canAdminUserGroups' privilege. The attacker initiates a request to update or create a user group, substituting the intended group name with a crafted malicious payload containing JavaScript.\nOnce the payload is saved, the application serves this data to any other authenticated administrator browsing the user management panel. The victim's browser, upon parsing the DOM to render the group list, interprets the malicious script within the application's origin.\nPost-exploitation impact is severe due to the context of execution. Since the code runs within an administrative session, the attacker can leverage the victim's session tokens to perform unauthorized administrative operations, modify system configurations, or exfiltrate sensitive user data. The impact is compounded by the fact that the vulnerability persists across user sessions until the malicious entry is removed from the database by a privileged user.\nThe vulnerability is present in versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. It does not require remote network exposure beyond access to the administrative panel, and is effectively a stored, persistent cross-site scripting attack vector requiring authenticated access."
}